CVE-2012-2678
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the...
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhashed#user#password attribute.
Exploit likelihood
What each source reports
NVD Score used
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhashed#user#password attribute.
- Record
CVE-2012-2678- CVSS 2.0
- 1.2 Low
AV:L/AC:H/Au:N/C:P/I:N/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhashed#user#password attribute.
- Record
CVE-2012-2678- Updated
- 2026-11-02
EUVDEUVD-2012-2660 No score
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhashed#user#password attribute.
- Record
EUVD-2012-2660- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p843-jwrx-ghw2 No score
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the...
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhashed#user#password attribute.
- Record
GHSA-p843-jwrx-ghw2- Updated
- 2026-11-02
OSVUBUNTU-CVE-2012-2678 No score
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhashed#user#password attribute.
- Record
UBUNTU-CVE-2012-2678- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
389-ds-baseRed Hat:enterprise_linux:6::client |
before 0:1.2.10.2-18.el6_3 | 0:1.2.10.2-18.el6_3 |
389-ds-base-debuginfoRed Hat:enterprise_linux:6::client |
before 0:1.2.10.2-18.el6_3 | 0:1.2.10.2-18.el6_3 |
389-ds-base-develRed Hat:enterprise_linux:6::client |
before 0:1.2.10.2-18.el6_3 | 0:1.2.10.2-18.el6_3 |
389-ds-base-libsRed Hat:enterprise_linux:6::client |
before 0:1.2.10.2-18.el6_3 | 0:1.2.10.2-18.el6_3 |
389-ds-baseRed Hat:enterprise_linux:6::computenode |
before 0:1.2.10.2-18.el6_3 | 0:1.2.10.2-18.el6_3 |
389-ds-base-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:1.2.10.2-18.el6_3 | 0:1.2.10.2-18.el6_3 |
389-ds-base-develRed Hat:enterprise_linux:6::computenode |
before 0:1.2.10.2-18.el6_3 | 0:1.2.10.2-18.el6_3 |
389-ds-base-libsRed Hat:enterprise_linux:6::computenode |
before 0:1.2.10.2-18.el6_3 | 0:1.2.10.2-18.el6_3 |
389-ds-baseRed Hat:enterprise_linux:6::server |
before 0:1.2.10.2-18.el6_3 | 0:1.2.10.2-18.el6_3 |
389-ds-base-debuginfoRed Hat:enterprise_linux:6::server |
before 0:1.2.10.2-18.el6_3 | 0:1.2.10.2-18.el6_3 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
389-ds-base-libsRed Hat:enterprise_linux:6::server |
before 0:1.2.10.2-18.el6_3 | 0:1.2.10.2-18.el6_3 |
389-ds-base-develRed Hat:enterprise_linux:6::server |
before 0:1.2.10.2-18.el6_3 | 0:1.2.10.2-18.el6_3 |
389-ds-baseRed Hat:enterprise_linux:6::workstation |
before 0:1.2.10.2-18.el6_3 | 0:1.2.10.2-18.el6_3 |
389-ds-base-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:1.2.10.2-18.el6_3 | 0:1.2.10.2-18.el6_3 |
389-ds-base-libsRed Hat:enterprise_linux:6::workstation |
before 0:1.2.10.2-18.el6_3 | 0:1.2.10.2-18.el6_3 |
389-ds-base-develRed Hat:enterprise_linux:6::workstation |
before 0:1.2.10.2-18.el6_3 | 0:1.2.10.2-18.el6_3 |
redhat-ds-baseRed Hat:directory_server:8::el5 |
before 0:8.2.10-3.el5dsrv | 0:8.2.10-3.el5dsrv |
redhat-ds-base-debuginfoRed Hat:directory_server:8::el5 |
before 0:8.2.10-3.el5dsrv | 0:8.2.10-3.el5dsrv |
redhat-ds-base-develRed Hat:directory_server:8::el5 |
before 0:8.2.10-3.el5dsrv | 0:8.2.10-3.el5dsrv |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-2678 is a low vulnerability (CVSS 1.2) in Fedoraproject 389 Directory Server, published July 3, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 50th percentile. Fixed in 389-ds-base 0:1.2.10.2-18.el6_3.
References
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19353
secunia.com/advisories/49734
h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03772083
osvdb.org/83336
securityfocus.com/bid/54153
directory.fedoraproject.org/wiki/Release_Notes
Show 17 moreShow less
rhn.redhat.com/errata/RHSA-2012-1041.html
nvd.nist.gov/vuln/detail/CVE-2012-2678
github.com/advisories/GHSA-p843-jwrx-ghw2
access.redhat.com/errata/RHSA-2012:0997
bugzilla.redhat.com/show_bug.cgi?id=829933
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0997.json
cve.org/CVERecord?id=CVE-2012-2678
ubuntu.com/security/CVE-2012-2678