CVE-2007-5373 - Vulnerability Details - OpenCVE

Description

ldapscripts 1.4 and 1.7 sends a password as a command line argument when calling some LDAP programs, which might allow local users to read the password by listing the process and its arguments, as demonstrated by a call to ldappasswd in the _changepassword function.

Published: 2007-10-11

Score: 2.1 Low

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:ldapscripts:ldapscripts:1.4:::::::*
	cpe:2.3:a:ldapscripts:ldapscripts:1.7:::::::*

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-1517-1	New ldapscripts packages fix information disclosure
EUVD	EUVD-2007-5351	ldapscripts 1.4 and 1.7 sends a password as a command line argument when calling some LDAP programs, which might allow local users to read the password by listing the process and its arguments, as demonstrated by a call to ldappasswd in the _changepassword function.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00075.

Key SSVC decision points have not yet been added.

References

Link	Providers
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=445582
http://secunia.com/advisories/27111
http://secunia.com/advisories/29395
http://www.debian.org/security/2008/dsa-1517
http://www.securityfocus.com/bid/25982
https://exchange.xforce.ibmcloud.com/vulnerabilities/37029

History

No history.

Subscriptions

Ldapscripts Ldapscripts

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-10-11T10:00:00.000Z

Updated: 2024-08-07T15:31:57.153Z

Reserved: 2007-10-10T00:00:00.000Z

Link: CVE-2007-5373

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2007-10-11T10:17:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-5373

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-310

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-10-06T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "ldapscripts 1.4 and 1.7 sends a password as a command line argument when calling some LDAP programs, which might allow local users to read the password by listing the process and its arguments, as demonstrated by a call to ldappasswd in the _changepassword function."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-28T12:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "DSA-1517", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2008/dsa-1517"}, {"name": "27111", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/27111"}, {"name": "25982", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/25982"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=445582"}, {"name": "29395", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/29395"}, {"name": "ldapscripts-commandline-info-disclosure(37029)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37029"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-5373", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "ldapscripts 1.4 and 1.7 sends a password as a command line argument when calling some LDAP programs, which might allow local users to read the password by listing the process and its arguments, as demonstrated by a call to ldappasswd in the _changepassword function."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "DSA-1517", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2008/dsa-1517"}, {"name": "27111", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/27111"}, {"name": "25982", "refsource": "BID", "url": "http://www.securityfocus.com/bid/25982"}, {"name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=445582", "refsource": "CONFIRM", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=445582"}, {"name": "29395", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/29395"}, {"name": "ldapscripts-commandline-info-disclosure(37029)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37029"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T15:31:57.153Z"}, "title": "CVE Program Container", "references": [{"name": "DSA-1517", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2008/dsa-1517"}, {"name": "27111", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/27111"}, {"name": "25982", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/25982"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=445582"}, {"name": "29395", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/29395"}, {"name": "ldapscripts-commandline-info-disclosure(37029)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37029"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-5373", "datePublished": "2007-10-11T10:00:00.000Z", "dateReserved": "2007-10-10T00:00:00.000Z", "dateUpdated": "2024-08-07T15:31:57.153Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ldapscripts:ldapscripts:1.4:*:*:*:*:*:*:*", "matchCriteriaId": "3E94361A-CBFC-4D9D-8FAF-E57B73342B74", "vulnerable": true}, {"criteria": "cpe:2.3:a:ldapscripts:ldapscripts:1.7:*:*:*:*:*:*:*", "matchCriteriaId": "1325F10A-9DF8-47FD-B29C-AE70114AC983", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ldapscripts 1.4 and 1.7 sends a password as a command line argument when calling some LDAP programs, which might allow local users to read the password by listing the process and its arguments, as demonstrated by a call to ldappasswd in the _changepassword function."}, {"lang": "es", "value": "ldapscripts 1.4 y 1.7 env\u00eda una contrase\u00f1a como un argumento de l\u00ednea de comandos cuando llama a algunos programas LDAP, lo cual podr\u00eda permitir a usuarios locales leer la contrase\u00f1a listando el proceso y sus argumentos, como se ha demostrado con una llamada a ldappasswd en la funci\u00f3n _changepasswords."}], "id": "CVE-2007-5373", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-10-11T10:17:00.000", "references": [{"source": "cve@mitre.org", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=445582"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/27111"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/29395"}, {"source": "cve@mitre.org", "url": "http://www.debian.org/security/2008/dsa-1517"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/25982"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37029"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=445582"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/27111"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/29395"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2008/dsa-1517"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/25982"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37029"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-310"}], "source": "nvd@nist.gov", "type": "Primary"}]}