Every CVE Search/ Get API key

CVE-2004-0823

OpenLDAP 1.0 through 2.1.19, as used in Apple Mac OS 10.3.4 and 10.3.5 and possibly other...

7.5 High

OpenLDAP 1.0 through 2.1.19, as used in Apple Mac OS 10.3.4 and 10.3.5 and possibly other operating systems, may allow certain authentication schemes to use hashed (crypt) passwords in the userPassword attribute as if they were plaintext passwords, which allows remote attackers to re-use hashed passwords without decrypting them.

Exploit likelihood

2.74%Up 0.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

OpenLDAP 1.0 through 2.1.19, as used in Apple Mac OS 10.3.4 and 10.3.5 and possibly other operating systems, may allow certain authentication schemes to use hashed (crypt) passwords in the userPassword attribute as if they were plaintext passwords, which allows remote attackers to re-use hashed passwords without decrypting them.

Record
CVE-2004-0823
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

OpenLDAP 1.0 through 2.1.19, as used in Apple Mac OS 10.3.4 and 10.3.5 and possibly other operating systems, may allow certain authentication schemes to use hashed (crypt) passwords in the userPassword attribute as if they were plaintext passwords, which allows remote attackers to re-use hashed passwords without decrypting them.

Record
CVE-2004-0823
Updated
2026-11-02
EUVDEUVD-2004-0821 No score

OpenLDAP 1.0 through 2.1.19, as used in Apple Mac OS 10.3.4 and 10.3.5 and possibly other operating systems, may allow certain authentication schemes to use hashed (crypt) passwords in the userPassword attribute as if they were plaintext passwords, which allows remote attackers to re-use hashed passwords without decrypting them.

Record
EUVD-2004-0821
Updated
2026-11-03
GitHub AdvisoriesGHSA-7rr4-25h7-4mj3 No score

OpenLDAP 1.0 through 2.1.19, as used in Apple Mac OS 10.3.4 and 10.3.5 and possibly other...

OpenLDAP 1.0 through 2.1.19, as used in Apple Mac OS 10.3.4 and 10.3.5 and possibly other operating systems, may allow certain authentication schemes to use hashed (crypt) passwords in the userPassword attribute as if they were plaintext passwords, which allows remote attackers to re-use hashed passwords without decrypting them.

Record
GHSA-7rr4-25h7-4mj3
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nss_ldap
Red Hat:enterprise_linux:3::as
From an advisory covering 2 CVEs
 before 0:207-17
0:207-17
nss_ldap-debuginfo
Red Hat:enterprise_linux:3::as
From an advisory covering 2 CVEs
 before 0:207-17
0:207-17
openldap
Red Hat:enterprise_linux:3::as
From an advisory covering 2 CVEs
 before 0:2.0.27-20
0:2.0.27-20
openldap-clients
Red Hat:enterprise_linux:3::as
From an advisory covering 2 CVEs
 before 0:2.0.27-20
0:2.0.27-20
openldap-debuginfo
Red Hat:enterprise_linux:3::as
From an advisory covering 2 CVEs
 before 0:2.0.27-20
0:2.0.27-20
openldap-devel
Red Hat:enterprise_linux:3::as
From an advisory covering 2 CVEs
 before 0:2.0.27-20
0:2.0.27-20
openldap-servers
Red Hat:enterprise_linux:3::as
From an advisory covering 2 CVEs
 before 0:2.0.27-20
0:2.0.27-20
nss_ldap
Red Hat:enterprise_linux:3::desktop
From an advisory covering 2 CVEs
 before 0:207-17
0:207-17
nss_ldap-debuginfo
Red Hat:enterprise_linux:3::desktop
From an advisory covering 2 CVEs
 before 0:207-17
0:207-17
openldap
Red Hat:enterprise_linux:3::desktop
From an advisory covering 2 CVEs
 before 0:2.0.27-20
0:2.0.27-20
Show 16 moreShow less
Affected packages
PackageAffectedFixed
openldap-clients
Red Hat:enterprise_linux:3::desktop
From an advisory covering 2 CVEs
 before 0:2.0.27-20
0:2.0.27-20
openldap-debuginfo
Red Hat:enterprise_linux:3::desktop
From an advisory covering 2 CVEs
 before 0:2.0.27-20
0:2.0.27-20
openldap-devel
Red Hat:enterprise_linux:3::desktop
From an advisory covering 2 CVEs
 before 0:2.0.27-20
0:2.0.27-20
nss_ldap
Red Hat:enterprise_linux:3::es
From an advisory covering 2 CVEs
 before 0:207-17
0:207-17
nss_ldap-debuginfo
Red Hat:enterprise_linux:3::es
From an advisory covering 2 CVEs
 before 0:207-17
0:207-17
openldap
Red Hat:enterprise_linux:3::es
From an advisory covering 2 CVEs
 before 0:2.0.27-20
0:2.0.27-20
openldap-clients
Red Hat:enterprise_linux:3::es
From an advisory covering 2 CVEs
 before 0:2.0.27-20
0:2.0.27-20
openldap-debuginfo
Red Hat:enterprise_linux:3::es
From an advisory covering 2 CVEs
 before 0:2.0.27-20
0:2.0.27-20
openldap-devel
Red Hat:enterprise_linux:3::es
From an advisory covering 2 CVEs
 before 0:2.0.27-20
0:2.0.27-20
openldap-servers
Red Hat:enterprise_linux:3::es
From an advisory covering 2 CVEs
 before 0:2.0.27-20
0:2.0.27-20
nss_ldap
Red Hat:enterprise_linux:3::ws
From an advisory covering 2 CVEs
 before 0:207-17
0:207-17
nss_ldap-debuginfo
Red Hat:enterprise_linux:3::ws
From an advisory covering 2 CVEs
 before 0:207-17
0:207-17
openldap
Red Hat:enterprise_linux:3::ws
From an advisory covering 2 CVEs
 before 0:2.0.27-20
0:2.0.27-20
openldap-clients
Red Hat:enterprise_linux:3::ws
From an advisory covering 2 CVEs
 before 0:2.0.27-20
0:2.0.27-20
openldap-debuginfo
Red Hat:enterprise_linux:3::ws
From an advisory covering 2 CVEs
 before 0:2.0.27-20
0:2.0.27-20
openldap-devel
Red Hat:enterprise_linux:3::ws
From an advisory covering 2 CVEs
 before 0:2.0.27-20
0:2.0.27-20

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2004-0823 is a high vulnerability (CVSS 7.5) in Openldap, published September 7, 2004. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.74%, the 86th percentile. No source names a fixed version.

References

Show 19 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open