Yüksek CVSS 7.5

CVE-2026-11770: Directory Server: güvenlik açığı

Yayın: 31 Temmuz 2026 13:16 · Güncelleme: 6 Kasım 2026 10:34

Açıklama (NVD)

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.

Özet bilgiler

Ürün: Redhat Directory Server
CVSS v3.1: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: %0,53 (yüzdelik 45)
CWE: CWE-90
Yama: Yok / bilinmiyor

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
redhat-directory-server	11.0	11.0	—
redhat-directory-server	12.0	12.0	—
redhat-directory-server	13.0	13.0	—
redhat-389-directory-server	—	—	—
redhat-enterprise-linux	7.0	7.0	—
redhat-enterprise-linux	8.0	8.0	—
redhat-enterprise-linux	9.0	9.0	—
redhat-enterprise-linux	10.0	10.0	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları