CVE-2018-14628
An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access...
CVE-2018-14628 is a medium vulnerability (CVSS 4.3) in Samba, published January 17, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.20%, the 68th percentile. Fixed in samba 4.18.9-r0.
An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store.
- Record
CVE-2018-14628- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
CVE List No score
An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store.
- Record
CVE-2018-14628- Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2018-6534
An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store.
- Record
EUVD-2018-6534- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-88v2-p2r7-rvpx
An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access...
An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store.
- Record
GHSA-88v2-p2r7-rvpx- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVALPINE-CVE-2018-14628
An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store.
- Record
ALPINE-CVE-2018-14628- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVAZL-13064
CVE-2018-14628 affecting package samba 4.12.5-7
An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store.
- Record
AZL-13064- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVAZL-36987
CVE-2018-14628 affecting package samba 4.18.3-2
An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store.
- Record
AZL-36987- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSV
An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store.
- Record
CVE-2018-14628- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-14628
An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store.
- Record
DEBIAN-CVE-2018-14628- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-14628
An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store.
- Record
UBUNTU-CVE-2018-14628- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2026-0142 No score
Updated samba packages fix security vulnerabilities
An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store. (CVE-2018-14628) Command injection in wins server hook script. (CVE-2025-10230) vfs_streams_xattr uninitialized memory write possible. (CVE-2025-9640)
- Record
MGASA-2026-0142- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13579-1 No score
ctdb-4.19.4+git.339.acf1ccaa020-1.1 on GA media
These are all security issues fixed in the ctdb-4.19.4+git.339.acf1ccaa020-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13579-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sambaAlpine:v3.18 |
4.0.0 up to 4.18.9-r0 | 4.18.9-r0 |
sambaAlpine:v3.19 |
4.0.0 up to 4.18.9-r0 | 4.18.9-r0 |
sambaAlpine:v3.20 |
4.0.0 up to 4.18.9-r0 | 4.18.9-r0 |
sambaAlpine:v3.21 |
4.0.0 up to 4.18.9-r0 | 4.18.9-r0 |
sambaAlpine:v3.22 |
4.0.0 up to 4.18.9-r0 | 4.18.9-r0 |
sambaAlpine:v3.23 |
4.0.0 up to 4.18.9-r0 | 4.18.9-r0 |
sambaAlpine:v3.24 |
4.0.0 up to 4.18.9-r0 | 4.18.9-r0 |
sambaAzure Linux:2 |
through 4.12.5-7 | None known |
sambaAzure Linux:3 |
through 4.18.3-2 | None known |
sambaDebian:12 |
before 2:4.17.12+dfsg-0+deb12u3, plus listed versions 2:4.17.10+dfsg-0+deb12u12:4.17.10+dfsg-0+deb12u1~bpo11+12:4.17.11+dfsg-0+deb12u12:4.17.12+dfsg-0+deb12u12:4.17.12+dfsg-0+deb12u1~bpo11+1 Show 7 moreShow less2:4.17.12+dfsg-0+deb12u22:4.17.8+dfsg-22:4.17.8+dfsg-2.12:4.17.9+dfsg-0+deb12u12:4.17.9+dfsg-0+deb12u22:4.17.9+dfsg-0+deb12u32:4.17.9+dfsg-0+deb12u3~bpo11+1 |
2:4.17.12+dfsg-0+deb12u3 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
sambaDebian:13 |
before 2:4.19.3+dfsg-1 | 2:4.19.3+dfsg-1 |
sambaDebian:14 |
before 2:4.19.3+dfsg-1 | 2:4.19.3+dfsg-1 |
sambaMageia:9 |
before 4.17.12-1.2.mga9 | 4.17.12-1.2.mga9 |
sambaUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2:3.6.18-1ubuntu32:4.0.10+dfsg-4ubuntu22:4.0.13+dfsg-1ubuntu12:4.1.3+dfsg-2ubuntu22:4.1.3+dfsg-2ubuntu3 Show 45 moreShow less2:4.1.3+dfsg-2ubuntu42:4.1.3+dfsg-2ubuntu52:4.1.6+dfsg-1ubuntu12:4.1.6+dfsg-1ubuntu22:4.1.6+dfsg-1ubuntu2.14.04.12:4.1.6+dfsg-1ubuntu2.14.04.22:4.1.6+dfsg-1ubuntu2.14.04.32:4.1.6+dfsg-1ubuntu2.14.04.42:4.1.6+dfsg-1ubuntu2.14.04.52:4.1.6+dfsg-1ubuntu2.14.04.72:4.1.6+dfsg-1ubuntu2.14.04.82:4.1.6+dfsg-1ubuntu2.14.04.92:4.1.6+dfsg-1ubuntu2.14.04.112:4.1.6+dfsg-1ubuntu2.14.04.122:4.1.6+dfsg-1ubuntu2.14.04.132:4.3.8+dfsg-0ubuntu0.14.04.22:4.3.9+dfsg-0ubuntu0.14.04.12:4.3.9+dfsg-0ubuntu0.14.04.32:4.3.11+dfsg-0ubuntu0.14.04.12:4.3.11+dfsg-0ubuntu0.14.04.22:4.3.11+dfsg-0ubuntu0.14.04.32:4.3.11+dfsg-0ubuntu0.14.04.42:4.3.11+dfsg-0ubuntu0.14.04.62:4.3.11+dfsg-0ubuntu0.14.04.72:4.3.11+dfsg-0ubuntu0.14.04.82:4.3.11+dfsg-0ubuntu0.14.04.92:4.3.11+dfsg-0ubuntu0.14.04.102:4.3.11+dfsg-0ubuntu0.14.04.112:4.3.11+dfsg-0ubuntu0.14.04.122:4.3.11+dfsg-0ubuntu0.14.04.132:4.3.11+dfsg-0ubuntu0.14.04.142:4.3.11+dfsg-0ubuntu0.14.04.162:4.3.11+dfsg-0ubuntu0.14.04.172:4.3.11+dfsg-0ubuntu0.14.04.192:4.3.11+dfsg-0ubuntu0.14.04.202:4.3.11+dfsg-0ubuntu0.14.04.20+esm12:4.3.11+dfsg-0ubuntu0.14.04.20+esm22:4.3.11+dfsg-0ubuntu0.14.04.20+esm32:4.3.11+dfsg-0ubuntu0.14.04.20+esm42:4.3.11+dfsg-0ubuntu0.14.04.20+esm62:4.3.11+dfsg-0ubuntu0.14.04.20+esm72:4.3.11+dfsg-0ubuntu0.14.04.20+esm82:4.3.11+dfsg-0ubuntu0.14.04.20+esm92:4.3.11+dfsg-0ubuntu0.14.04.20+esm112:4.3.11+dfsg-0ubuntu0.14.04.20+esm12 |
None known |
sambaUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2:4.1.17+dfsg-4ubuntu22:4.1.20+dfsg-1ubuntu12:4.1.20+dfsg-1ubuntu22:4.1.20+dfsg-1ubuntu32:4.1.20+dfsg-1ubuntu5 Show 41 moreShow less2:4.3.3+dfsg-1ubuntu12:4.3.3+dfsg-1ubuntu22:4.3.3+dfsg-1ubuntu32:4.3.6+dfsg-1ubuntu12:4.3.8+dfsg-0ubuntu12:4.3.9+dfsg-0ubuntu0.16.04.12:4.3.9+dfsg-0ubuntu0.16.04.22:4.3.9+dfsg-0ubuntu0.16.04.32:4.3.11+dfsg-0ubuntu0.16.04.12:4.3.11+dfsg-0ubuntu0.16.04.32:4.3.11+dfsg-0ubuntu0.16.04.52:4.3.11+dfsg-0ubuntu0.16.04.62:4.3.11+dfsg-0ubuntu0.16.04.72:4.3.11+dfsg-0ubuntu0.16.04.82:4.3.11+dfsg-0ubuntu0.16.04.92:4.3.11+dfsg-0ubuntu0.16.04.102:4.3.11+dfsg-0ubuntu0.16.04.112:4.3.11+dfsg-0ubuntu0.16.04.122:4.3.11+dfsg-0ubuntu0.16.04.132:4.3.11+dfsg-0ubuntu0.16.04.152:4.3.11+dfsg-0ubuntu0.16.04.162:4.3.11+dfsg-0ubuntu0.16.04.172:4.3.11+dfsg-0ubuntu0.16.04.182:4.3.11+dfsg-0ubuntu0.16.04.192:4.3.11+dfsg-0ubuntu0.16.04.202:4.3.11+dfsg-0ubuntu0.16.04.212:4.3.11+dfsg-0ubuntu0.16.04.232:4.3.11+dfsg-0ubuntu0.16.04.242:4.3.11+dfsg-0ubuntu0.16.04.252:4.3.11+dfsg-0ubuntu0.16.04.262:4.3.11+dfsg-0ubuntu0.16.04.272:4.3.11+dfsg-0ubuntu0.16.04.282:4.3.11+dfsg-0ubuntu0.16.04.292:4.3.11+dfsg-0ubuntu0.16.04.302:4.3.11+dfsg-0ubuntu0.16.04.312:4.3.11+dfsg-0ubuntu0.16.04.322:4.3.11+dfsg-0ubuntu0.16.04.342:4.3.11+dfsg-0ubuntu0.16.04.34+esm12:4.3.11+dfsg-0ubuntu0.16.04.34+esm22:4.3.11+dfsg-0ubuntu0.16.04.34+esm32:4.3.11+dfsg-0ubuntu0.16.04.34+esm4 |
None known |
sambaUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2:4.6.7+dfsg-1ubuntu32:4.7.1+dfsg-1ubuntu12:4.7.3+dfsg-1ubuntu12:4.7.4+dfsg-1ubuntu12:4.7.6+dfsg~ubuntu-0ubuntu1 Show 27 moreShow less2:4.7.6+dfsg~ubuntu-0ubuntu22:4.7.6+dfsg~ubuntu-0ubuntu2.22:4.7.6+dfsg~ubuntu-0ubuntu2.42:4.7.6+dfsg~ubuntu-0ubuntu2.52:4.7.6+dfsg~ubuntu-0ubuntu2.62:4.7.6+dfsg~ubuntu-0ubuntu2.72:4.7.6+dfsg~ubuntu-0ubuntu2.92:4.7.6+dfsg~ubuntu-0ubuntu2.102:4.7.6+dfsg~ubuntu-0ubuntu2.112:4.7.6+dfsg~ubuntu-0ubuntu2.132:4.7.6+dfsg~ubuntu-0ubuntu2.142:4.7.6+dfsg~ubuntu-0ubuntu2.152:4.7.6+dfsg~ubuntu-0ubuntu2.162:4.7.6+dfsg~ubuntu-0ubuntu2.172:4.7.6+dfsg~ubuntu-0ubuntu2.182:4.7.6+dfsg~ubuntu-0ubuntu2.192:4.7.6+dfsg~ubuntu-0ubuntu2.202:4.7.6+dfsg~ubuntu-0ubuntu2.212:4.7.6+dfsg~ubuntu-0ubuntu2.232:4.7.6+dfsg~ubuntu-0ubuntu2.242:4.7.6+dfsg~ubuntu-0ubuntu2.262:4.7.6+dfsg~ubuntu-0ubuntu2.272:4.7.6+dfsg~ubuntu-0ubuntu2.282:4.7.6+dfsg~ubuntu-0ubuntu2.292:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm12:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm22:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm3 |
None known |
sambaUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2:4.10.7+dfsg-0ubuntu22:4.10.7+dfsg-0ubuntu32:4.11.1+dfsg-3ubuntu12:4.11.1+dfsg-3ubuntu22:4.11.1+dfsg-3ubuntu4 Show 32 moreShow less2:4.11.5+dfsg-1ubuntu12:4.11.5+dfsg-1ubuntu22:4.11.6+dfsg-0ubuntu12:4.11.6+dfsg-0ubuntu1.12:4.11.6+dfsg-0ubuntu1.22:4.11.6+dfsg-0ubuntu1.32:4.11.6+dfsg-0ubuntu1.42:4.11.6+dfsg-0ubuntu1.52:4.11.6+dfsg-0ubuntu1.62:4.11.6+dfsg-0ubuntu1.82:4.11.6+dfsg-0ubuntu1.92:4.11.6+dfsg-0ubuntu1.102:4.13.14+dfsg-0ubuntu0.20.04.12:4.13.14+dfsg-0ubuntu0.20.04.22:4.13.14+dfsg-0ubuntu0.20.04.32:4.13.14+dfsg-0ubuntu0.20.04.42:4.13.17~dfsg-0ubuntu0.21.04.12:4.13.17~dfsg-0ubuntu0.21.04.22:4.13.17~dfsg-0ubuntu1.20.04.12:4.13.17~dfsg-0ubuntu1.20.04.22:4.13.17~dfsg-0ubuntu1.20.04.42:4.13.17~dfsg-0ubuntu1.20.04.52:4.15.13+dfsg-0ubuntu0.20.04.12:4.15.13+dfsg-0ubuntu0.20.04.22:4.15.13+dfsg-0ubuntu0.20.04.32:4.15.13+dfsg-0ubuntu0.20.04.42:4.15.13+dfsg-0ubuntu0.20.04.52:4.15.13+dfsg-0ubuntu0.20.04.62:4.15.13+dfsg-0ubuntu0.20.04.72:4.15.13+dfsg-0ubuntu0.20.04.82:4.15.13+dfsg-0ubuntu0.20.04.8+esm12:4.15.13+dfsg-0ubuntu0.20.04.8+esm2 |
None known |
sambaUbuntu:22.04:LTS |
All versions, plus listed versions 2:4.13.5+dfsg-2ubuntu22:4.13.5+dfsg-2ubuntu32:4.13.14+dfsg-0ubuntu12:4.13.14+dfsg-0ubuntu22:4.15.5~dfsg-0ubuntu1 Show 19 moreShow less2:4.15.5~dfsg-0ubuntu22:4.15.5~dfsg-0ubuntu42:4.15.5~dfsg-0ubuntu52:4.15.5~dfsg-0ubuntu5.12:4.15.9+dfsg-0ubuntu0.22:4.15.9+dfsg-0ubuntu0.32:4.15.13+dfsg-0ubuntu12:4.15.13+dfsg-0ubuntu1.12:4.15.13+dfsg-0ubuntu1.22:4.15.13+dfsg-0ubuntu1.32:4.15.13+dfsg-0ubuntu1.42:4.15.13+dfsg-0ubuntu1.52:4.15.13+dfsg-0ubuntu1.62:4.15.13+dfsg-0ubuntu1.72:4.15.13+dfsg-0ubuntu1.82:4.15.13+dfsg-0ubuntu1.92:4.15.13+dfsg-0ubuntu1.102:4.15.13+dfsg-0ubuntu1.122:4.15.13+dfsg-0ubuntu1.13 |
None known |
sambaUbuntu:24.04:LTS |
before 2:4.19.4+dfsg-3ubuntu1, plus listed versions 2:4.18.6+dfsg-1ubuntu22:4.18.6+dfsg-1ubuntu2.12:4.18.6+dfsg-1ubuntu2.2 |
2:4.19.4+dfsg-3ubuntu1 |
sambaopenSUSE:Tumbleweed |
before 4.19.4+git.339.acf1ccaa020-1.1 | 4.19.4+git.339.acf1ccaa020-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugzilla.samba.org/show_bug.cgi?id=13595
bugzilla.redhat.com/show_bug.cgi?id=1625445
openwall.com/lists/oss-security/2023/11/28/4
lists.fedoraproject.org/archives/list/[email protected]/message/6DK57HQRTCDOZDIIICYWQ4Z5IQXTWVVW
security.netapp.com/advisory/ntap-20230223-0008
Show 12 moreShow less
nvd.nist.gov/vuln/detail/CVE-2018-14628
github.com/advisories/GHSA-88v2-p2r7-rvpx
security.alpinelinux.org/vuln/CVE-2018-14628
security-tracker.debian.org/tracker/CVE-2018-14628
advisories.mageia.org/MGASA-2026-0142.html
bugs.mageia.org/show_bug.cgi?id=34672
ubuntu.com/security/CVE-2018-14628
marc.info?l=oss-security&m=170118854915655
samba.org/samba/security/CVE-2018-14628.html
cve.org/CVERecord?id=CVE-2018-14628
suse.com/security/cve/CVE-2018-14628
Left out here: 3 versions. The JSON record has them.