CVE-2026-18651
Gravedad CVSS v3.1:
MEDIA
Tipo:
CWE-287
Autenticación incorrecta
Fecha de publicación:
03/08/2026
Última modificación:
09/08/2026
Descripción
*** Pendiente de traducción *** A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed authenticated state on the connection is not reverted. A client that supplies valid credentials for an account that has been administratively locked can continue to use the same connection with that account's privileges, defeating account lock as an access-revocation control.
Impacto
Puntuación base 3.x
5.40
Gravedad 3.x
MEDIA
Productos y versiones vulnerables
| CPE | Desde | Hasta |
|---|---|---|
| cpe:2.3:a:redhat:directory_server:11.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:redhat:directory_server:12.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:redhat:directory_server:13.0:*:*:*:*:*:*:* | ||
| cpe:2.3:o:redhat:389_directory_server:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | ||
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | ||
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | ||
| cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página