CVE-2022-1949

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Jun 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-19509.8The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action ava CVE-2022-19516.1The core plugin for kitestudio WordPress plugin before 2.3.1 does not sanitise and escape some parameters before outputting them back in a r CVE-2022-19529.8The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation whic CVE-2022-19539.1The Product Configurator for WooCommerce WordPress plugin before 1.2.32 suffers from an arbitrary file deletion vulnerability via an AJAX ac CVE-2022-19545.3A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting all versions from 1.0.2 prior to 14.10.5, 15.0 prior to 15.0.CVE-2022-19554.6Session 1.13.0 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user d CVE-2022-19564.3The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its settings, which coul CVE-2022-19574.3The Comment License WordPress plugin before 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers CVE-2022-19586.5A vulnerability classified as critical has been found in FileCloud. Affected is an unknown function of the component NTFS Handler. The manip CVE-2022-19596.6AppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This is possible because th CVE-2022-19604.3The MyCSS WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a l CVE-2022-19614.8The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the `gtm4