What’s Vulnerable › Vulnerabilities

CVE-2018-10919

• Severity: medium (CVSS 6.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-08-22 · updated 2026-06-17
• Weakness: CWE-203

Description

The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.

Affected products

• Canonical Ubuntu Linux: 14.04, 16.04, 18.04
• Debian Linux: 9.0
• Samba: from 4.0.0 before 4.6.16; from 4.7.0 before 4.7.9; from 4.8.0 before 4.8.4 — fixed in 4.6.16, 4.7.9, 4.8.4

How to fix

Upgrade to a fixed version: Samba 4.6.16, 4.7.9, 4.8.4. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/105081
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10919
• https://security.gentoo.org/glsa/202003-52
• https://security.netapp.com/advisory/ntap-20180814-0001/
• https://usn.ubuntu.com/3738-1/
• https://www.debian.org/security/2018/dsa-4271
• https://www.samba.org/samba/security/CVE-2018-10919.html
• http://www.securityfocus.com/bid/105081
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10919
• https://security.gentoo.org/glsa/202003-52
• https://security.netapp.com/advisory/ntap-20180814-0001/
• https://usn.ubuntu.com/3738-1/

Get alerted when CVE-2018-10919 or the next vulnerability affects your stack