{"id":"CVE-2013-2219","aliases":["DEBIAN-CVE-2013-2219","EUVD-2013-2172","GHSA-8368-c7f9-h333","MGASA-2013-0263","RHSA-2013:1116","RHSA-2013:1119","UBUNTU-CVE-2013-2219"],"status":"published","title":"The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict...","description":"The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01756,"percentile":0.78099,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2013-07-31T10:00:00Z","modified":"2026-09-01T20:03:15Z","fixes":[{"ecosystem":"Debian:12","package":"389-ds-base","fixed_in":["1.3.2.9-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"389-ds-base","fixed_in":["1.3.2.9-1"],"sources":["osv"]},{"ecosystem":"Red Hat:directory_server:8::el5","package":"redhat-ds-base","fixed_in":["0:8.2.11-13.el5dsrv"],"sources":["osv"]},{"ecosystem":"Red Hat:directory_server:8::el5","package":"redhat-ds-base-debuginfo","fixed_in":["0:8.2.11-13.el5dsrv"],"sources":["osv"]},{"ecosystem":"Red Hat:directory_server:8::el5","package":"redhat-ds-base-devel","fixed_in":["0:8.2.11-13.el5dsrv"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"389-ds-base","fixed_in":["0:1.2.11.15-20.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"389-ds-base-debuginfo","fixed_in":["0:1.2.11.15-20.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"389-ds-base-devel","fixed_in":["0:1.2.11.15-20.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"389-ds-base-libs","fixed_in":["0:1.2.11.15-20.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"389-ds-base","fixed_in":["0:1.2.11.15-20.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"389-ds-base-debuginfo","fixed_in":["0:1.2.11.15-20.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"389-ds-base-devel","fixed_in":["0:1.2.11.15-20.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"389-ds-base-libs","fixed_in":["0:1.2.11.15-20.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"389-ds-base","fixed_in":["0:1.2.11.15-20.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"389-ds-base-debuginfo","fixed_in":["0:1.2.11.15-20.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"389-ds-base-libs","fixed_in":["0:1.2.11.15-20.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"389-ds-base-devel","fixed_in":["0:1.2.11.15-20.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"389-ds-base","fixed_in":["0:1.2.11.15-20.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"389-ds-base-debuginfo","fixed_in":["0:1.2.11.15-20.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"389-ds-base-libs","fixed_in":["0:1.2.11.15-20.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"389-ds-base-devel","fixed_in":["0:1.2.11.15-20.el6_4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2.9-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2.9-1"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0.8-1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:directory_server:8::el5","package":"redhat-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.2.11-13.el5dsrv"}]}]},{"source":"osv","ecosystem":"Red Hat:directory_server:8::el5","package":"redhat-ds-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.2.11-13.el5dsrv"}]}]},{"source":"osv","ecosystem":"Red Hat:directory_server:8::el5","package":"redhat-ds-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.2.11-13.el5dsrv"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-20.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"389-ds-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-20.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"389-ds-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-20.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"389-ds-base-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-20.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-20.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"389-ds-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-20.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"389-ds-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-20.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"389-ds-base-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-20.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-20.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"389-ds-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-20.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"389-ds-base-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-20.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"389-ds-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-20.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-20.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"389-ds-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-20.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"389-ds-base-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-20.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"389-ds-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-20.el6_4"}]}]}],"products":[{"vendor":"fedoraproject","product":"389_directory_server"},{"vendor":"redhat","product":"directory_server"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2013-1119.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=979508","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1116.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2219","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8368-c7f9-h333"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-2219","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0263.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10138","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10889","tags":["report"]},{"url":"https://rhn.redhat.com/errata/RHSA-2013-1119.html","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2013-1182.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1116","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1116.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2219","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2219","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1119","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=984970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=987850","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1119.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-2219","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-2219","description":"The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute.","status":"published","published":"2013-07-31T10:00:00Z","modified":"2024-08-06T15:27:41.088Z","updated_at":"2026-11-02T14:34:56.19172Z"}],"euvd":[{"id":"EUVD-2013-2172","description":"The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute.","status":"published","published":"2013-07-31T10:00:00Z","modified":"2024-08-06T15:27:41Z","updated_at":"2026-11-03T01:56:39.164386Z"}],"ghsa":[{"id":"GHSA-8368-c7f9-h333","title":"The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict...","description":"The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute.","status":"published","published":"2022-05-17T00:22:57Z","modified":"2023-02-03T05:01:34Z","updated_at":"2026-11-02T14:52:59.998713Z"}],"nvd":[{"id":"CVE-2013-2219","description":"The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute.","status":"published","published":"2013-07-31T13:20:25.577Z","modified":"2026-06-16T23:52:57.9Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:31.592595Z"}],"osv":[{"id":"CVE-2013-2219","description":"The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute.","status":"published","published":"2013-07-31T13:20:25Z","modified":"2026-04-16T06:24:14.77235042Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-2219","description":"The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute.","status":"published","published":"2013-07-31T13:20:25.577Z","modified":"2026-09-01T20:03:15.687278095Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"MGASA-2013-0263","title":"Updated 389-ds-base packag fixes security vulnerabilies and incorrect group usage","description":"Updated 389-ds-base packages fix security vulnerabilities:\n\nIt was discovered that the 389 Directory Server did not honor defined\nattribute access controls when evaluating search filter expressions. A\nremote attacker (with permission to query the Directory Server) could use\nthis flaw to determine the values of restricted attributes via a series of\nsearch queries with filter conditions that used restricted attributes\n(CVE-2013-2219).\n\nIt was discovered that the 389 Directory Server did not properly handle the\nreceipt of certain MOD operations with a bogus Distinguished Name (DN). A\nremote, unauthenticated attacker could use this flaw to cause the 389\nDirectory Server to crash (CVE-2013-4283).\n\nAdditionally, problems of wrong default group nobody (from upstream) as well\nas the 389-ds server not starting after a reboot have been fixed (mga#10138).\n","status":"published","published":"2013-08-30T17:23:22Z","modified":"2026-04-16T06:22:30.67114002Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"RHSA-2013:1116","title":"Red Hat Security Advisory: redhat-ds-base security and bug fix update","status":"published","published":"2024-09-15T20:57:08Z","modified":"2025-11-22T10:45:31Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2013:1119","title":"Red Hat Security Advisory: 389-ds-base security and bug fix update","status":"published","published":"2024-09-15T20:57:13Z","modified":"2026-06-26T12:20:54.267489357Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"UBUNTU-CVE-2013-2219","description":"The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute.","status":"withdrawn","published":"2013-07-31T13:20:00Z","modified":"2025-07-16T07:31:15.330889Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}