CVE-2013-2219: Medium severity red hat 389 directory server vulnerability
A flaw was found in how Red Hat Directory Server and the 389 Directory Server would handle access controls to certain attributes of an entry. A user with access to the Directory Server could use a series of searches to guess the values of other attributes that they should not be able to see. If a user had access (authenticated or anonymous, depending on whether or not the Directory Server allows anonymous access), they could use this to obtain information that should be restricted due to access controls.
Other sources
The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2219?
CVE-2013-2219 has a medium severity rating due to its potential for information disclosure.
How do I fix CVE-2013-2219?
To fix CVE-2013-2219, you should update to the latest version of Red Hat Directory Server or 389 Directory Server that contains the appropriate patches.
What systems are affected by CVE-2013-2219?
CVE-2013-2219 affects Red Hat Directory Server versions up to 8.2, as well as version 7.1 and 8.0.
Can CVE-2013-2219 lead to data leakage?
Yes, CVE-2013-2219 can potentially lead to data leakage by allowing an unauthorized user to infer values of hidden attributes.
What type of vulnerability is CVE-2013-2219?
CVE-2013-2219 is an access control vulnerability related to improper handling of attribute visibility in the directory server.