CVE-2014-0132

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-03-18 · updated 2026-06-17
Weakness: CWE-287

Description

The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind.

Affected products

Red Hat, Inc. 389-ds-base: through 1.2.11.25; 1.2.11.1, 1.2.11.5, 1.2.11.6, 1.2.11.8, 1.2.11.9, 1.2.11.10 (+11)

References

http://rhn.redhat.com/errata/RHSA-2014-0292.html
http://secunia.com/advisories/57412
http://secunia.com/advisories/57427
https://fedorahosted.org/389/changeset/76acff12a86110d4165f94e2cba13ef5c7ebc38a/
https://fedorahosted.org/389/ticket/47739
http://rhn.redhat.com/errata/RHSA-2014-0292.html
http://secunia.com/advisories/57412
http://secunia.com/advisories/57427
https://fedorahosted.org/389/changeset/76acff12a86110d4165f94e2cba13ef5c7ebc38a/
https://fedorahosted.org/389/ticket/47739

Get alerted when CVE-2014-0132 or the next vulnerability affects your stack