Every CVE Search/ Get API key

CVE-2014-0132

The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote...

6.5 MediumFix available

The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind.

Exploit likelihood

2.19%Up 1.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.5

The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind.

Record
CVE-2014-0132
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-287
Updated
2026-11-02
CVE List No score

The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind.

Record
CVE-2014-0132
Updated
2026-11-02
EUVDEUVD-2014-0193 No score

The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind.

Record
EUVD-2014-0193
Updated
2026-11-03
GitHub AdvisoriesGHSA-3483-6grv-x2wh No score

The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote...

The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind.

Record
GHSA-3483-6grv-x2wh
Weakness
CWE-287
Updated
2026-11-02
OSV No score

The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind.

Record
CVE-2014-0132
Updated
2026-11-02
OSVDEBIAN-CVE-2014-0132 No score

The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind.

Record
DEBIAN-CVE-2014-0132
Updated
2026-11-02
OSVMGASA-2014-0145 No score

Updated 389-ds-base package fixes security vulnerability

It was discovered that the 389 Directory Server did not properly handle certain SASL-based authentication mechanisms. A user able to authenticate to the directory using these SASL mechanisms could connect as any other directory user, including the administrative Directory Manager account. This could allow them to modify configuration values, as well as read and write any data the directory holds (CVE-2014-0132).

Record
MGASA-2014-0145
Updated
2026-11-02
OSVUBUNTU-CVE-2014-0132 No score

The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind.

Record
UBUNTU-CVE-2014-0132
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
389-ds-base
Debian:12
 before 1.3.2.9-1.1
1.3.2.9-1.1
389-ds-base
Debian:13
 before 1.3.2.9-1.1
1.3.2.9-1.1
389-ds-base
Mageia:3
 before 1.3.0.9-1.1.mga3
1.3.0.9-1.1.mga3
389-ds-base
Mageia:4
 before 1.3.2.7-1.1.mga4
1.3.2.7-1.1.mga4
389-ds-base
Red Hat:enterprise_linux:6::client
 before 0:1.2.11.15-32.el6_5
0:1.2.11.15-32.el6_5
389-ds-base-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:1.2.11.15-32.el6_5
0:1.2.11.15-32.el6_5
389-ds-base-devel
Red Hat:enterprise_linux:6::client
 before 0:1.2.11.15-32.el6_5
0:1.2.11.15-32.el6_5
389-ds-base-libs
Red Hat:enterprise_linux:6::client
 before 0:1.2.11.15-32.el6_5
0:1.2.11.15-32.el6_5
389-ds-base
Red Hat:enterprise_linux:6::computenode
 before 0:1.2.11.15-32.el6_5
0:1.2.11.15-32.el6_5
389-ds-base-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:1.2.11.15-32.el6_5
0:1.2.11.15-32.el6_5
Show 10 moreShow less
Affected packages
PackageAffectedFixed
389-ds-base-devel
Red Hat:enterprise_linux:6::computenode
 before 0:1.2.11.15-32.el6_5
0:1.2.11.15-32.el6_5
389-ds-base-libs
Red Hat:enterprise_linux:6::computenode
 before 0:1.2.11.15-32.el6_5
0:1.2.11.15-32.el6_5
389-ds-base
Red Hat:enterprise_linux:6::server
 before 0:1.2.11.15-32.el6_5
0:1.2.11.15-32.el6_5
389-ds-base-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:1.2.11.15-32.el6_5
0:1.2.11.15-32.el6_5
389-ds-base-libs
Red Hat:enterprise_linux:6::server
 before 0:1.2.11.15-32.el6_5
0:1.2.11.15-32.el6_5
389-ds-base-devel
Red Hat:enterprise_linux:6::server
 before 0:1.2.11.15-32.el6_5
0:1.2.11.15-32.el6_5
389-ds-base
Red Hat:enterprise_linux:6::workstation
 before 0:1.2.11.15-32.el6_5
0:1.2.11.15-32.el6_5
389-ds-base-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:1.2.11.15-32.el6_5
0:1.2.11.15-32.el6_5
389-ds-base-libs
Red Hat:enterprise_linux:6::workstation
 before 0:1.2.11.15-32.el6_5
0:1.2.11.15-32.el6_5
389-ds-base-devel
Red Hat:enterprise_linux:6::workstation
 before 0:1.2.11.15-32.el6_5
0:1.2.11.15-32.el6_5

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0132 is a medium vulnerability (CVSS 6.5) in Fedoraproject 389 Directory Server, published March 18, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.19%, the 82nd percentile. Fixed in 389-ds-base 1.3.2.9-1.1.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open