CVE-2017-7551

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-209CWE-640

Affected software

VendorProductVersions
389 Directory Server389-ds-basebefore 1.3.5.19 and 1.3.6.7

References

Timeline

Published
Aug 16, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-75529.8A flaw was discovered in the file editor of millicore, affecting versions before 3.19.0 and 4.x before 4.5.0, which allows files to be execuCVE-2017-75536.3The external_request api call in App Studio (millicore) allows server side request forgery (SSRF). An attacker could use this flaw to probe CVE-2017-75546.1It was found that the App Studio component of RHMAP 4.4 executes javascript provided by a user. An attacker could use this flaw to execute aCVE-2017-75559.8Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. AttackerCVE-2017-75568.8Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their weCVE-2017-75578.8dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.CVE-2017-75587.5A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() fCVE-2017-75596.1In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 wCVE-2017-75605.5It was found that rhnsd PID files are created as world-writable that allows local attackers to fill the disks or to kill selected processes.CVE-2017-75617.5Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS comCVE-2017-75626.5An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A CVE-2017-75638.1In ARM Trusted Firmware 1.3, RO memory is always executable at AArch64 Secure EL1, allowing attackers to bypass the MT_EXECUTE_NEVER protect
CVE-2017-7551: Critical severity, CVSS 9.8 | Vulnix