CVE-2007-5373

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-10-11 · updated 2026-06-16
Weakness: CWE-310

Description

ldapscripts 1.4 and 1.7 sends a password as a command line argument when calling some LDAP programs, which might allow local users to read the password by listing the process and its arguments, as demonstrated by a call to ldappasswd in the _changepassword function.

Affected products

Ldapscripts: 1.4, 1.7

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=445582
http://secunia.com/advisories/27111
http://secunia.com/advisories/29395
http://www.debian.org/security/2008/dsa-1517
http://www.securityfocus.com/bid/25982
https://exchange.xforce.ibmcloud.com/vulnerabilities/37029
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=445582
http://secunia.com/advisories/27111
http://secunia.com/advisories/29395
http://www.debian.org/security/2008/dsa-1517
http://www.securityfocus.com/bid/25982
https://exchange.xforce.ibmcloud.com/vulnerabilities/37029

Get alerted when CVE-2007-5373 or the next vulnerability affects your stack