Every CVE Search/ Get API key

CVE-2014-8105

389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access...

5.0 MediumFix available

389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors.

Exploit likelihood

2.11%Up 0.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors.

Record
CVE-2014-8105
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List No score

389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors.

Record
CVE-2014-8105
Updated
2026-11-02
EUVDEUVD-2014-7952 No score

389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors.

Record
EUVD-2014-7952
Updated
2026-11-03
GitHub AdvisoriesGHSA-vgvq-9gqr-48c9 No score

389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access...

389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors.

Record
GHSA-vgvq-9gqr-48c9
Weakness
CWE-200
Updated
2026-11-02
OSV No score

389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors.

Record
CVE-2014-8105
Updated
2026-11-02
OSVDEBIAN-CVE-2014-8105 No score

389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors.

Record
DEBIAN-CVE-2014-8105
Updated
2026-11-02
OSVMGASA-2015-0108 No score

Updated 389-ds-base packages fix security vulnerabilities

An information disclosure flaw was found in the way the 389 Directory Server stored information in the Changelog that is exposed via the 'cn=changelog' LDAP sub-tree. An unauthenticated user could in certain cases use this flaw to read data from the Changelog, which could include sensitive information such as plain-text passwords (CVE-2014-8105).

It was found that when the nsslapd-unhashed-pw-switch 389 Directory Server configuration option was set to "off", it did not prevent the writing of unhashed passwords into the Changelog. This could potentially allow an authenticated user able to access the Changelog to read sensitive information (CVE-2014-8112).

Record
MGASA-2015-0108
Updated
2026-11-02
OSVopenSUSE-SU-2024:10157-1 No score

389-ds-1.3.4.14-1.2 on GA media

These are all security issues fixed in the 389-ds-1.3.4.14-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10157-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
389-ds-base
Debian:12
 before 1.3.3.5-4
1.3.3.5-4
389-ds-base
Debian:13
 before 1.3.3.5-4
1.3.3.5-4
389-ds-base
Mageia:4
From an advisory covering 2 CVEs
 before 1.3.3.9-1.mga4
1.3.3.9-1.mga4
389-ds-base
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:1.3.3.1-13.el7
0:1.3.3.1-13.el7
389-ds-base-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:1.3.3.1-13.el7
0:1.3.3.1-13.el7
389-ds-base-devel
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:1.3.3.1-13.el7
0:1.3.3.1-13.el7
389-ds-base-libs
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:1.3.3.1-13.el7
0:1.3.3.1-13.el7
389-ds-base
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:1.3.3.1-13.el7
0:1.3.3.1-13.el7
389-ds-base-debuginfo
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:1.3.3.1-13.el7
0:1.3.3.1-13.el7
389-ds-base-devel
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:1.3.3.1-13.el7
0:1.3.3.1-13.el7
Show 26 moreShow less
Affected packages
PackageAffectedFixed
389-ds-base-libs
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:1.3.3.1-13.el7
0:1.3.3.1-13.el7
389-ds-base-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:1.3.3.1-13.el7
0:1.3.3.1-13.el7
389-ds-base-devel
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:1.3.3.1-13.el7
0:1.3.3.1-13.el7
389-ds-base
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:1.3.3.1-13.el7
0:1.3.3.1-13.el7
389-ds-base-libs
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:1.3.3.1-13.el7
0:1.3.3.1-13.el7
389-ds-base-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:1.3.3.1-13.el7
0:1.3.3.1-13.el7
389-ds-base-devel
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:1.3.3.1-13.el7
0:1.3.3.1-13.el7
389-ds-base
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:1.3.3.1-13.el7
0:1.3.3.1-13.el7
389-ds-base-libs
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:1.3.3.1-13.el7
0:1.3.3.1-13.el7
389-ds-base
Red Hat:enterprise_linux:6::client
 before 0:1.2.11.15-50.el6_6
0:1.2.11.15-50.el6_6
389-ds-base-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:1.2.11.15-50.el6_6
0:1.2.11.15-50.el6_6
389-ds-base-devel
Red Hat:enterprise_linux:6::client
 before 0:1.2.11.15-50.el6_6
0:1.2.11.15-50.el6_6
389-ds-base-libs
Red Hat:enterprise_linux:6::client
 before 0:1.2.11.15-50.el6_6
0:1.2.11.15-50.el6_6
389-ds-base
Red Hat:enterprise_linux:6::computenode
 before 0:1.2.11.15-50.el6_6
0:1.2.11.15-50.el6_6
389-ds-base-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:1.2.11.15-50.el6_6
0:1.2.11.15-50.el6_6
389-ds-base-devel
Red Hat:enterprise_linux:6::computenode
 before 0:1.2.11.15-50.el6_6
0:1.2.11.15-50.el6_6
389-ds-base-libs
Red Hat:enterprise_linux:6::computenode
 before 0:1.2.11.15-50.el6_6
0:1.2.11.15-50.el6_6
389-ds-base
Red Hat:enterprise_linux:6::server
 before 0:1.2.11.15-50.el6_6
0:1.2.11.15-50.el6_6
389-ds-base-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:1.2.11.15-50.el6_6
0:1.2.11.15-50.el6_6
389-ds-base-libs
Red Hat:enterprise_linux:6::server
 before 0:1.2.11.15-50.el6_6
0:1.2.11.15-50.el6_6
389-ds-base-devel
Red Hat:enterprise_linux:6::server
 before 0:1.2.11.15-50.el6_6
0:1.2.11.15-50.el6_6
389-ds-base
Red Hat:enterprise_linux:6::workstation
 before 0:1.2.11.15-50.el6_6
0:1.2.11.15-50.el6_6
389-ds-base-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:1.2.11.15-50.el6_6
0:1.2.11.15-50.el6_6
389-ds-base-libs
Red Hat:enterprise_linux:6::workstation
 before 0:1.2.11.15-50.el6_6
0:1.2.11.15-50.el6_6
389-ds-base-devel
Red Hat:enterprise_linux:6::workstation
 before 0:1.2.11.15-50.el6_6
0:1.2.11.15-50.el6_6
389-ds
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 1.3.4.14-1.2
1.3.4.14-1.2

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-8105 is a medium vulnerability (CVSS 5.0) in Fedoraproject 389 Directory Server, published March 10, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.11%, the 81st percentile. Fixed in 389-ds-base 1.3.3.5-4.

References

Show 192 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open