CVE-2013-0172
Samba 4.0.x before 4.0.1, in certain Active Directory domain-controller configurations, does not...
Samba 4.0.x before 4.0.1, in certain Active Directory domain-controller configurations, does not properly interpret Access Control Entries that are based on an objectClass, which allows remote authenticated users to bypass intended restrictions on modifying LDAP directory objects by leveraging (1) objectClass access by a user, (2) objectClass access by a group, or (3) write access to an attribute.
Exploit likelihood
What each source reports
NVD Score used
Samba 4.0.x before 4.0.1, in certain Active Directory domain-controller configurations, does not properly interpret Access Control Entries that are based on an objectClass, which allows remote authenticated users to bypass intended restrictions on modifying LDAP directory objects by leveraging (1) objectClass access by a user, (2) objectClass access by a group, or (3) write access to an attribute.
- Record
CVE-2013-0172- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Samba 4.0.x before 4.0.1, in certain Active Directory domain-controller configurations, does not properly interpret Access Control Entries that are based on an objectClass, which allows remote authenticated users to bypass intended restrictions on modifying LDAP directory objects by leveraging (1) objectClass access by a user, (2) objectClass access by a group, or (3) write access to an attribute.
- Record
CVE-2013-0172- Updated
- 2026-11-02
EUVDEUVD-2013-0211 No score
Samba 4.0.x before 4.0.1, in certain Active Directory domain-controller configurations, does not properly interpret Access Control Entries that are based on an objectClass, which allows remote authenticated users to bypass intended restrictions on modifying LDAP directory objects by leveraging (1) objectClass access by a user, (2) objectClass access by a group, or (3) write access to an attribute.
- Record
EUVD-2013-0211- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pccc-3h39-28j7 No score
Samba 4.0.x before 4.0.1, in certain Active Directory domain-controller configurations, does not...
Samba 4.0.x before 4.0.1, in certain Active Directory domain-controller configurations, does not properly interpret Access Control Entries that are based on an objectClass, which allows remote authenticated users to bypass intended restrictions on modifying LDAP directory objects by leveraging (1) objectClass access by a user, (2) objectClass access by a group, or (3) write access to an attribute.
- Record
GHSA-pccc-3h39-28j7- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10069-1 No score
ctdb-4.5.0-1.1 on GA media
These are all security issues fixed in the ctdb-4.5.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10069-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sambaopenSUSE:Tumbleweed From an advisory covering 56 CVEs |
before 4.5.0-1.1 | 4.5.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-0172 is a low vulnerability (CVSS 3.5) in Samba, published January 17, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.43%, the 84th percentile. No source names a fixed version.
References
samba.org/samba/security/CVE-2013-0172
nvd.nist.gov/vuln/detail/CVE-2013-0172
github.com/advisories/GHSA-pccc-3h39-28j7
suse.com/security/cve/CVE-2009-1886
Show 53 moreShow less