CVE-2022-1949: fedoraproject fedora
Vulnerability summary
CVE-2022-1949 is a high (CVSS 7.5) vulnerability in fedoraproject fedora. EPSS estimates a 1.50% chance of exploitation in the next 30 days, higher than 73.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5 · Related 5Timeline
- 01-06-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.50%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
+0.04 pp
From 1.47% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat3 products
- 389_directory_server≥ 1.3.0.0, ≤ 2.0.0
- directory_server11.0 | 12.0
- enterprise_linux8.0 | 9.0
Debian1 product
- 389-ds-base< 2.3.1-1
Fedoraproject1 product
- fedoraEOL34 | 35 | 36
Mageia1 product
- 389-ds-base< 1.4.0.26-8.5.mga8
Opensuse1 product
- 389-ds&distro=openSUSE Tumbleweed< 2.1.1~git22.faef73366-1.1
Ubuntu1 product
- 389-ds-baseAll versions (No fix recorded)
6 vendors · 8 products
References
9 links- bugzilla.redhat.com/show_bug.cgi?id=2091781X Refsource MISCREPORTIssue TrackingPatchThird Party Advisory
