Kritik CVSS 9.8

CVE-2026-18922: CVE-2026-18922: hatalı kimlik doğrulama

Yayın: 7 Eylül 2026 18:17 · Güncelleme: 6 Kasım 2026 10:48

Açıklama (NVD)

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.

Özet bilgiler

CVSS v3.1: 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: %0,56 (yüzdelik 47)
CWE: CWE-287
Yama: Yok / bilinmiyor

Kaynaklar

Uygulamada aç Tüm CVE kayıtları