CVE-2012-2746

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-07-03 · updated 2026-06-16
Weakness: CWE-310

Description

389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the password of a LDAP user has been changed and audit logging is enabled, saves the new password to the log in plain text, which allows remote authenticated users to read the password.

Affected products

Red Hat, Inc. 389-ds-base: through 1.2.11.5; 1.2.1, 1.2.2, 1.2.3, 1.2.5, 1.2.5-rc1, 1.2.5-rc2 (+31)
RedHat Directory Server: through 8.2; 7.1, 8.0, 8.1

References

http://directory.fedoraproject.org/wiki/Release_Notes
http://rhn.redhat.com/errata/RHSA-2012-0997.html
http://rhn.redhat.com/errata/RHSA-2012-1041.html
http://secunia.com/advisories/49734
http://www.osvdb.org/83329
http://www.securityfocus.com/bid/54153
https://bugzilla.redhat.com/show_bug.cgi?id=833482
https://exchange.xforce.ibmcloud.com/vulnerabilities/76595
https://fedorahosted.org/389/ticket/365
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03772083
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19241
http://directory.fedoraproject.org/wiki/Release_Notes

Get alerted when CVE-2012-2746 or the next vulnerability affects your stack