An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status‑check extended operation of 389 Directory Server. The injected filter is executed against cn:config with elevated replication plugin privileges, and the operation returns only a boolean result, which the attacker can use to infer sensitive server configuration metadata such as replication bind DNs and the password storage scheme. The vulnerability is a classic LDAP injection flaw, identified as CWE‑90.

Red Hat Directory Server versions 11, 12, and 13, as well as Red Hat Enterprise Linux releases 6 through 10 (including the 389‑ds‑base component).

The CVSS score of 7.5 indicates moderate to high severity. EPSS is below 1%, suggesting that current exploitation attempts are very rare, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is unauthenticated remote, requiring network access to the LDAP service, but once the extended operation is available the attacker can perform the injection without any special credentials. The risk is primarily a confidentiality breach of configuration data, with a relatively low but non‑zero probability of exploitation.