CVE-2013-5572

Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML source code.

Published Bycve@mitre.org

Published DateOct 01, 2013, 03:48

Weakness Type (CWE):CWE-264

CVSS Metrics

Base Score

3.5

Vector String

AV:N/AC:M/Au:S/C:P/I:N/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

NONE

Availability (A)

NONE

References

http://archives.neohapsis.com/archives/fulldisclosure/2013-09/0149.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132376.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132377.html

Weakness Type (CWE):CWE-264

CVSS Metrics

Base Score

3.5

Vector String

AV:N/AC:M/Au:S/C:P/I:N/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

NONE

Availability (A)

NONE