CVE-2018-10871

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores passwords in plaintext format in their respective changelog files. An attacker with sufficiently high privileges, such as root or Directory Manager, can query these files in order to retrieve plaintext passwords.

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-312

Affected software

Vendor	Product	Versions
[UNKNOWN]	389-ds-base	389-ds-base 1.3.8.5; 389-ds-base 1.4.0.12

References

https://access.redhat.com/errata/RHSA-2019:3401
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10871Issue Tracking, Mitigation, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/08/msg00032.htmlMailing List, Third Party Advisory
https://pagure.io/389-ds-base/issue/49789Issue Tracking, Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3401
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10871Issue Tracking, Mitigation, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/08/msg00032.htmlMailing List, Third Party Advisory
https://pagure.io/389-ds-base/issue/49789Issue Tracking, Third Party Advisory

Timeline

Published: Jul 18, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-108725.5A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. CVE-2018-108738.8A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bou CVE-2018-108747.8In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attac CVE-2018-108757.8A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a m CVE-2018-108765.5A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free is possible in ext4_ext_remove_space() function when mounting CVE-2018-108776.5Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 f CVE-2018-108787.8A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write and a denial of service or unspecified CVE-2018-108797.8A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and a denia CVE-2018-10888.1A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also moun CVE-2018-108805.5Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in e CVE-2018-108815.5A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function, a den CVE-2018-108825.5A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/transaction.c code, a den