9.8crit
CVE-2018-1337
Credential leak in org.apache.directory.api:apache-ldap-api
Also known as GHSA-cfw5-v7cw-69cw
Published 8 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
5.2%
percentile 92%
Public exploits
0
none known
Summary
In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any information contained in this request (including the credentials when sending a BIND request).
Exploit prediction (EPSS)
5.15% probability of exploitation in the next 30 days, higher than 92% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.directory.api:apache-ldap-api | <1.0.2 | 1.0.2 |
Affected products
- Apache Software Foundation Apache Directory
Classification
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
- securityfocus.com /bid/104744 · vdb-entry, x_refsource_BID, x_transferred
- lists.apache.org /thread.html/d66081195e9a02ee7cc20fb243b60467d1419586eed28297d820768f%40%3Cdev.directory.a · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/r1a258430d820a90ff9d4558319296cc517ff2252327d7b3546d16749%40%3Cjira.kafka.apa · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/r56b304fb9960c869995efbb31da3b9b7c6d53ee31f7f7048eb80434b%40%3Cdev.kafka.apac · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/r55e74532e7f9e84ecfa56b4e0a50a5fe0ba6f7a76880520e4400b0d7%40%3Cjira.kafka.apa · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/r4da40aa50cfdb2158898f2bc6df81feec1d42c6a06db6537d5cc0496%40%3Cjira.kafka.apa · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/r0e645b3f6ca977dc60b7cec231215c59a9471736c2402c1fef5a0616%40%3Cjira.kafka.apa · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/r1815fb5b0c345f571c740e7a1b48d7477647edd4ffcf9d5321e69446%40%3Cdev.kafka.apac · mailing-list, x_refsource_MLIST, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2018-1337 · advisory
- github.com /advisories/GHSA-cfw5-v7cw-69cw · advisory
- lists.apache.org /thread.html/d66081195e9a02ee7cc20fb243b60467d1419586eed28297d820768f@%3Cdev.directory.apa · web
- lists.apache.org /thread.html/r0e645b3f6ca977dc60b7cec231215c59a9471736c2402c1fef5a0616@%3Cjira.kafka.apach · web
- lists.apache.org /thread.html/r1815fb5b0c345f571c740e7a1b48d7477647edd4ffcf9d5321e69446@%3Cdev.kafka.apache · web
- lists.apache.org /thread.html/r1a258430d820a90ff9d4558319296cc517ff2252327d7b3546d16749@%3Cjira.kafka.apach · web
- lists.apache.org /thread.html/r4da40aa50cfdb2158898f2bc6df81feec1d42c6a06db6537d5cc0496@%3Cjira.kafka.apach · web
- lists.apache.org /thread.html/r55e74532e7f9e84ecfa56b4e0a50a5fe0ba6f7a76880520e4400b0d7@%3Cjira.kafka.apach · web
- lists.apache.org /thread.html/r56b304fb9960c869995efbb31da3b9b7c6d53ee31f7f7048eb80434b@%3Cdev.kafka.apache · web
Sources
- CVE List: CVE-2018-1337
- GitHub Advisory: GHSA-cfw5-v7cw-69cw
- NVD: CVE-2018-1337
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.