{"id":"CVE-2018-10871","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-10871","generatedAt":"2026-10-29T00:57:54.347Z","title":"389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information.","description":"389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores passwords in plaintext format in their respective changelog files. An attacker with sufficiently high privileges, such as root or Directory Manager, can query these files in order to retrieve plaintext passwords.","published":"2018-07-18T13:29:00.000Z","lastModified":"2026-06-17T01:34:48.000Z","status":"Modified","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.0","score":7.2,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-312"],"affected":["fedoraproject/389 directory server","debian/debian linux"],"epss":{"score":0.01127,"percentile":0.66155,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (1.13%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2019:3401","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10871","tags":["Issue Tracking","Mitigation","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://lists.debian.org/debian-lts-announce/2018/08/msg00032.html","tags":["Mailing List","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://pagure.io/389-ds-base/issue/49789","tags":["Issue Tracking","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2019:3401","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10871","tags":["Issue Tracking","Mitigation","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2018/08/msg00032.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://pagure.io/389-ds-base/issue/49789","tags":["Issue Tracking","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-10871","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}