CVE-2008-5112
The LDAP server in Active Directory in Microsoft Windows 2000 SP4 and Server 2003 SP1 and SP2 responds differently to a failed bind attempt depending on whether the user account exists and is permitted to login, which allows remote attackers to…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 17.6%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
The LDAP server in Active Directory in Microsoft Windows 2000 SP4 and Server 2003 SP1 and SP2 responds differently to a failed bind attempt depending on whether the user account exists and is permitted to login, which allows remote attackers to enumerate valid usernames via a series of LDAP bind requests, as demonstrated by ldapuserenum.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 17.59% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- microsoft/windows · microsoft/windows 2000
- Source
- cve@mitre.org
References
- http://labs.portcullis.co.uk/application/ldapuserenum/
- http://www.portcullis-security.com/294.php
- http://www.securityfocus.com/bid/32305Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46628
- http://labs.portcullis.co.uk/application/ldapuserenum/
- http://www.portcullis-security.com/294.php
- http://www.securityfocus.com/bid/32305Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46628
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.