Skip to main content

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2018-10919

Medium
6.5/10

Summary

The Samba Active Directory LDAP server was vulnerable to an Information Disclosure Flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions 4.0.x prior to 4.6.16, 4.7.x prior to 4.7.9 and 4.8.x prior to 4.8.4 are vulnerable.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • NONE

CWE-200 - Information Exposure

An information exposure vulnerability is categorized as an information flow (IF) weakness, which can potentially allow unauthorized access to otherwise classified information in the application, such as confidential personal information (demographics, financials, health records, etc.), business secrets, and the application's internal environment.

References

Advisory Timeline

  • Published