Vulnerability-Lookup

CVE-2019-10224 (GCVE-0-2019-10224)

Vulnerability from cvelistv5 – Published: 2019-11-25 00:00 – Updated: 2024-08-04 22:17

Summary

A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information.

Severity

4.3 (Medium)


                        
                          CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-522

Assigner

redhat redhat root

References

3 references

URL	Tags
https://pagure.io/389-ds-base/issue/50251
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2…
https://lists.debian.org/debian-lts-announce/2023…	mailing-list

Impacted products

1 product

Vendor	Product	Version	CPE status
Red Hat	389-ds-base	Affected: 389-ds-base 1.4.x.x before 1.4.1.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T22:17:18.918Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pagure.io/389-ds-base/issue/50251"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10224"
          },
          {
            "name": "[debian-lts-announce] 20230424 [SECURITY] [DLA 3399-1] 389-ds-base security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "389-ds-base",
          "vendor": "Red Hat",
          "versions": [
            {
              "status": "affected",
              "version": "389-ds-base 1.4.x.x before 1.4.1.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-24T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://pagure.io/389-ds-base/issue/50251"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10224"
        },
        {
          "name": "[debian-lts-announce] 20230424 [SECURITY] [DLA 3399-1] 389-ds-base security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2019-10224",
    "datePublished": "2019-11-25T00:00:00.000Z",
    "dateReserved": "2019-03-27T00:00:00.000Z",
    "dateUpdated": "2024-08-04T22:17:18.918Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2019-10224",
      "date": "2026-09-16",
      "epss": "0.00396",
      "percentile": "0.33373"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:fedoraproject:389_directory_server:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.4.0.0\", \"versionEndExcluding\": \"1.4.1.3\", \"matchCriteriaId\": \"74563673-2E02-4592-BBB8-0ACC8D0C107F\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information.\"}, {\"lang\": \"es\", \"value\": \"Se ha encontrado un fallo en 389-ds-base versiones 1.4.x.x anteriores a 1.4.1.3. Cuando se ejecuta en modo verbose, los comandos dscreate y dsconf pueden mostrar informaci\\u00f3n confidencial, tales como la contrase\\u00f1a de Directory Manager. Un atacante, capaz de visualizar la pantalla o grabar la salida de error est\\u00e1ndar del terminal, podr\\u00eda utilizar este fallo para conseguir informaci\\u00f3n confidencial.\"}]",
      "id": "CVE-2019-10224",
      "lastModified": "2024-11-21T04:18:41.753",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 4.6, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"PHYSICAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 0.9, \"impactScore\": 3.6}], \"cvssMetricV30\": [{\"source\": \"secalert@redhat.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\", \"baseScore\": 4.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"PHYSICAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 0.7, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:P/I:N/A:N\", \"baseScore\": 2.1, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 3.9, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2019-11-25T16:15:13.440",
      "references": "[{\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10224\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Issue Tracking\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://pagure.io/389-ds-base/issue/50251\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10224\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://pagure.io/389-ds-base/issue/50251\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"secalert@redhat.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-522\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-200\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2019-10224\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2019-11-25T16:15:13.440\",\"lastModified\":\"2024-11-21T04:18:41.753\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information.\"},{\"lang\":\"es\",\"value\":\"Se ha encontrado un fallo en 389-ds-base versiones 1.4.x.x anteriores a 1.4.1.3. Cuando se ejecuta en modo verbose, los comandos dscreate y dsconf pueden mostrar informaci\u00f3n confidencial, tales como la contrase\u00f1a de Directory Manager. Un atacante, capaz de visualizar la pantalla o grabar la salida de error est\u00e1ndar del terminal, podr\u00eda utilizar este fallo para conseguir informaci\u00f3n confidencial.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":4.6,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"PHYSICAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":0.9,\"impactScore\":3.6}],\"cvssMetricV30\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"PHYSICAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":0.7,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":2.1,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-522\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fedoraproject:389_directory_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.4.0.0\",\"versionEndExcluding\":\"1.4.1.3\",\"matchCriteriaId\":\"74563673-2E02-4592-BBB8-0ACC8D0C107F\"}]}]}],\"references\":[{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10224\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://pagure.io/389-ds-base/issue/50251\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10224\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://pagure.io/389-ds-base/issue/50251\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-02-20T19:53:02+00:00",
      "cve": "CVE-2019-10224",
      "id": "CVE-2019-10224",
      "initial_release_date": "2019-01-01T00:00:00+00:00",
      "product_status:fixed": "42",
      "product_status:known_not_affected": "9",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "389-ds-base: using dscreate in verbose mode results in information disclosure",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-10224.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2025-10-07T09:33:31Z",
      "cve": "CVE-2019-10224",
      "id": "CVE-2019-10224",
      "initial_release_date": "2023-02-15T04:13:27Z",
      "product_status:known_not_affected": "52",
      "product_status:recommended": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2019-10224",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2019-10224.json",
      "version": "10"
    }
  }
}

CNVD-2020-03178

Vulnerability from cnvd - Published: 2020-01-21

Title

Red Hat 389 Directory Server信息泄露漏洞（CNVD-2020-03178）

Description

Red Hat 389 Directory Server是一款企业级的Linux目录服务器。 Red Hat 389 Directory Server verbose模式存在安全漏洞，远程攻击者可以利用漏洞提交特殊的请求，可获取敏感信息。

Severity

低

Patch Name

Red Hat 389 Directory Server信息泄露漏洞（CNVD-2020-03178）的补丁

Patch Description

Red Hat 389 Directory Server是一款企业级的Linux目录服务器。 Red Hat 389 Directory Server verbose模式存在安全漏洞，远程攻击者可以利用漏洞提交特殊的请求，可获取敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布相关漏洞补丁链接，请及时更新： https://access.redhat.com/errata/RHSA-2019:3401

Reference

https://access.redhat.com/errata/RHSA-2019:3401

Impacted products

Name
Red Hat 389 Directory Server >=1.4.0.0，<1.4.1.3

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-10224",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2019-10224"
    }
  },
  "description": "Red Hat 389 Directory Server\u662f\u4e00\u6b3e\u4f01\u4e1a\u7ea7\u7684Linux\u76ee\u5f55\u670d\u52a1\u5668\u3002\n\nRed Hat 389 Directory Server verbose\u6a21\u5f0f\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6f0f\u6d1e\u63d0\u4ea4\u7279\u6b8a\u7684\u8bf7\u6c42\uff0c\u53ef\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u76f8\u5173\u6f0f\u6d1e\u8865\u4e01\u94fe\u63a5\uff0c\u8bf7\u53ca\u65f6\u66f4\u65b0\uff1a\r\nhttps://access.redhat.com/errata/RHSA-2019:3401",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-03178",
  "openTime": "2020-01-21",
  "patchDescription": "Red Hat 389 Directory Server\u662f\u4e00\u6b3e\u4f01\u4e1a\u7ea7\u7684Linux\u76ee\u5f55\u670d\u52a1\u5668\u3002\r\n\r\nRed Hat 389 Directory Server verbose\u6a21\u5f0f\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6f0f\u6d1e\u63d0\u4ea4\u7279\u6b8a\u7684\u8bf7\u6c42\uff0c\u53ef\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Red Hat 389 Directory Server\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2020-03178\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Red Hat 389 Directory Server \u003e=1.4.0.0\uff0c\u003c1.4.1.3"
  },
  "referenceLink": "https://access.redhat.com/errata/RHSA-2019:3401",
  "serverity": "\u4f4e",
  "submitTime": "2019-11-14",
  "title": "Red Hat 389 Directory Server\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2020-03178\uff09"
}

FKIE_CVE-2019-10224

Vulnerability from fkie_nvd - Published: 2019-11-25 16:15 - Updated: 2026-06-17 02:10

Severity

4.6 (Medium) - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
secalert@redhat.com	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10224	Issue Tracking, Third Party Advisory
secalert@redhat.com	https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
secalert@redhat.com	https://pagure.io/389-ds-base/issue/50251	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10224	Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
af854a3a-2127-422b-91ae-364da2661108	https://pagure.io/389-ds-base/issue/50251	Third Party Advisory

Impacted products

	Vendor	Product	Version
	fedoraproject	389_directory_server	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "389-ds-base",
          "vendor": "Red Hat",
          "versions": [
            {
              "status": "affected",
              "version": "389-ds-base 1.4.x.x before 1.4.1.3"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fedoraproject:389_directory_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "74563673-2E02-4592-BBB8-0ACC8D0C107F",
              "versionEndExcluding": "1.4.1.3",
              "versionStartIncluding": "1.4.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information."
    },
    {
      "lang": "es",
      "value": "Se ha encontrado un fallo en 389-ds-base versiones 1.4.x.x anteriores a 1.4.1.3. Cuando se ejecuta en modo verbose, los comandos dscreate y dsconf pueden mostrar informaci\u00f3n confidencial, tales como la contrase\u00f1a de Directory Manager. Un atacante, capaz de visualizar la pantalla o grabar la salida de error est\u00e1ndar del terminal, podr\u00eda utilizar este fallo para conseguir informaci\u00f3n confidencial."
    }
  ],
  "id": "CVE-2019-10224",
  "lastModified": "2026-06-17T02:10:31.870",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.1,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 0.7,
        "impactScore": 3.6,
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "NONE",
          "baseScore": 4.6,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-11-25T16:15:13.440",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10224"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://pagure.io/389-ds-base/issue/50251"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10224"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://pagure.io/389-ds-base/issue/50251"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-349X-PCH6-942W

Vulnerability from github – Published: 2022-05-24 17:01 – Updated: 2023-04-24 09:30

Details

Severity

4.6 (Medium)


                  
                    CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2019-10224"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-522"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-11-25T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information.",
  "id": "GHSA-349x-pch6-942w",
  "modified": "2023-04-24T09:30:19Z",
  "published": "2022-05-24T17:01:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10224"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10224"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html"
    },
    {
      "type": "WEB",
      "url": "https://pagure.io/389-ds-base/issue/50251"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2019-10224

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

Aliases

CVE-2019-10224

Aliases

CVE-2019-10224

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2019-10224",
    "description": "A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information.",
    "id": "GSD-2019-10224",
    "references": [
      "https://www.suse.com/security/cve/CVE-2019-10224.html",
      "https://access.redhat.com/errata/RHSA-2019:3401",
      "https://alas.aws.amazon.com/cve/html/CVE-2019-10224.html",
      "https://linux.oracle.com/cve/CVE-2019-10224.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2019-10224"
      ],
      "details": "A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information.",
      "id": "GSD-2019-10224",
      "modified": "2023-12-13T01:23:58.138527Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2019-10224",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "389-ds-base",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "389-ds-base 1.4.x.x before 1.4.1.3"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Red Hat"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information."
          }
        ]
      },
      "impact": {
        "cvss": [
          [
            {
              "vectorString": "4.3/CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "version": "3.0"
            }
          ]
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-522"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://pagure.io/389-ds-base/issue/50251",
            "refsource": "MISC",
            "url": "https://pagure.io/389-ds-base/issue/50251"
          },
          {
            "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10224",
            "refsource": "CONFIRM",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10224"
          },
          {
            "name": "[debian-lts-announce] 20230424 [SECURITY] [DLA 3399-1] 389-ds-base security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:fedoraproject:389_directory_server:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.4.1.3",
                "versionStartIncluding": "1.4.0.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2019-10224"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-200"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://pagure.io/389-ds-base/issue/50251",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://pagure.io/389-ds-base/issue/50251"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10224",
              "refsource": "CONFIRM",
              "tags": [
                "Issue Tracking",
                "Third Party Advisory"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10224"
            },
            {
              "name": "[debian-lts-announce] 20230424 [SECURITY] [DLA 3399-1] 389-ds-base security update",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 2.1,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "LOW",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 0.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2023-04-24T09:15Z",
      "publishedDate": "2019-11-25T16:15Z"
    }
  }
}

RHSA-2019:3401

Vulnerability from csaf_redhat - Published: 2019-11-05 21:17 - Updated: 2026-06-30 11:35

Summary

Red Hat Security Advisory: 389-ds:1.4 security, bug fix, and enhancement update

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2019-10224.

CVE-2019-10224

When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information.

4.3 (Medium)


                
                  CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Fixed: 42 products

https://access.redhat.com/errata/RHSA-2019:3401

Open the full advisory

RHSA-2019_3401

Vulnerability from csaf_redhat - Published: 2019-11-05 21:17 - Updated: 2024-11-22 13:22

Summary

Red Hat Security Advisory: 389-ds:1.4 security, bug fix, and enhancement update

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2019-10224.

CVE-2019-10224

4.3 (Medium)


                
                  CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Fixed: 43 products

https://access.redhat.com/errata/RHSA-2019:3401

Open the full advisory

ubuntu-cve-2019-10224

Vulnerability from osv_ubuntu

Published

2019-11-25 16:15

Modified

2026-05-20 14:51

Summary

Details

Severity

4.3 (Medium)


                    
                      CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.6 (Medium)


                    
                      CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2019-10224	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=1677147	REPORT
	https://pagure.io/389-ds-base/issue/50251	REPORT
	https://pagure.io/389-ds-base/c/632ecb90d96ac0535…	REPORT
	https://www.cve.org/CVERecord?id=CVE-2019-10224	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "389-ds",
            "binary_version": "1.3.4.9-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "389-ds-base",
            "binary_version": "1.3.4.9-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "389-ds-base-libs",
            "binary_version": "1.3.4.9-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "389-ds-base",
        "purl": "pkg:deb/ubuntu/389-ds-base@1.3.4.9-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.3.3.12-1build1",
        "1.3.3.13-1",
        "1.3.4.5-2",
        "1.3.4.8-1",
        "1.3.4.8-3",
        "1.3.4.8-3ubuntu1",
        "1.3.4.8-4",
        "1.3.4.9-1",
        "1.3.4.9-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "389-ds",
            "binary_version": "1.3.7.10-1ubuntu1+esm1"
          },
          {
            "binary_name": "389-ds-base",
            "binary_version": "1.3.7.10-1ubuntu1+esm1"
          },
          {
            "binary_name": "389-ds-base-libs",
            "binary_version": "1.3.7.10-1ubuntu1+esm1"
          },
          {
            "binary_name": "python3-dirsrvtests",
            "binary_version": "1.3.7.10-1ubuntu1+esm1"
          },
          {
            "binary_name": "python3-lib389",
            "binary_version": "1.3.7.10-1ubuntu1+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "389-ds-base",
        "purl": "pkg:deb/ubuntu/389-ds-base@1.3.7.10-1ubuntu1+esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.3.7.5-1",
        "1.3.7.5-1build1",
        "1.3.7.5-1build2",
        "1.3.7.9-1",
        "1.3.7.10-1",
        "1.3.7.10-1ubuntu1",
        "1.3.7.10-1ubuntu1+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "389-ds",
            "binary_version": "3.1.2+vendor1-2"
          },
          {
            "binary_name": "389-ds-base",
            "binary_version": "3.1.2+vendor1-2"
          },
          {
            "binary_name": "389-ds-base-libs",
            "binary_version": "3.1.2+vendor1-2"
          },
          {
            "binary_name": "cockpit-389-ds",
            "binary_version": "3.1.2+vendor1-2"
          },
          {
            "binary_name": "python3-lib389",
            "binary_version": "3.1.2+vendor1-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "389-ds-base",
        "purl": "pkg:deb/ubuntu/389-ds-base@3.1.2+vendor1-2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.2+dfsg1-1",
        "3.1.2+vendor1-2"
      ]
    }
  ],
  "aliases": [],
  "details": "A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information.",
  "id": "UBUNTU-CVE-2019-10224",
  "modified": "2026-05-20T14:51:17Z",
  "published": "2019-11-25T16:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2019-10224"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1677147"
    },
    {
      "type": "REPORT",
      "url": "https://pagure.io/389-ds-base/issue/50251"
    },
    {
      "type": "REPORT",
      "url": "https://pagure.io/389-ds-base/c/632ecb90d96ac0535656f5aaf67fd2be4b81d310"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-10224"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2019-10224"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2019-10224 (GCVE-0-2019-10224)

CNVD-2020-03178

FKIE_CVE-2019-10224

GHSA-349X-PCH6-942W

GSD-2019-10224

RHSA-2019:3401

RHSA-2019_3401

ubuntu-cve-2019-10224

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature

Related by attack behaviour