Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.0

389 Directory Server lets moved entries bypass access rules

CVE-2012-4450 · published 14 years ago
Summary

In version 1.2.10 of 389 Directory Server, when an entry is renamed or moved, the system fails to adjust its access controls. This mistake lets users who are already logged in and have limited rights see or change data they shouldn’t. Apply the latest software update or patches to fix the access‑control handling.

What to do
  • Update debian 389-ds-base to version 1.2.11.15-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian 389-ds-base < 1.2.11.15-1
Fix: upgrade to 1.2.11.15-1
Debian:13 debian 389-ds-base < 1.2.11.15-1
Fix: upgrade to 1.2.11.15-1
– fedoraproject 389_directory_server 1.2.10
cpe:2.3:a:fedoraproject:389_directory_server:1.2.10:*:*:*:*:*:*:*
Original advisory text
389 Directory Server 1.2.10 does not properly update the ACL when a DN entry is moved by a modrdn operation, which allows remote authenticated users with certain permissions to bypass ACL restricti...
389 Directory Server 1.2.10 does not properly update the ACL when a DN entry is moved by a modrdn operation, which allows remote authenticated users with certain permissions to bypass ACL restrictions and access the DN entry.
References
Severity
6.0 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published1 Oct 2012
Updated3 Nov 2026
First seen3 Sep 2026
Sources
DEBIAN-CVE-2012-4450 · OSV
CVE-2012-4450 · NVD
Track software like this
Free during beta