Skip to main content

389 Directory Server CVE-2024-6237

MEDIUM
Improper Handling of Missing Values (CWE-230)
2024-07-09 secalert@redhat.com
Denial Of Service Red Hat Enterprise Linux Directory Server 389 Directory Server
6.5
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-230
ASVS 5.0
V2 - Validation and Business Logic Missing parameter handling
Impact

CVSS score of 6.5 (MEDIUM). Attack characteristics: network attack vector, low complexity, low privileges required, no user interaction not required.
Exploit ScenarioDerived

This vulnerability can be exploited remotely over the network. Successful exploitation could compromise the medium-severity affected system.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
No patch listed yet 0.9% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

A flaw was found in the 389 Directory Server. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified under CWE-230. A flaw was found in the 389 Directory Server. This flaw allows an unauthenticated user to cause a systematic server crash while sending a specific extended search request, leading to a denial of service. Affected products include: Redhat Directory Server, Redhat 389 Directory Server, Redhat Enterprise Linux.

Know when 389 Directory Server gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionNVD

A flaw was found in the 389 Directory Server. This flaw allows an unauthenticated user to cause a systematic server crash while sending a specific extended search request, leading to a denial of service.

Threat Intelligence Overview

EPSS Score
0.9%
Top 44% exploitable
Data Quality
3 sources
Confidence: Low
NVD CVE.org EPSS GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.9%
Patch available No
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

33
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +32
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)NVD

cpe:2.3:a:redhat:directory_server:12.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:389_directory_server:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

More in 389 Directory Server

View all
CVE-2017-7551 CRITICAL POC
9.8 Aug 16

389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout du
CVE-2018-14624 HIGH POC
7.5 Sep 06

A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16. Rated high severity (CVSS
CVE-2014-0132 MEDIUM POC
6.5 Mar 18

The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to conn
CVE-2022-0996 MEDIUM POC
6.5 Mar 23

A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause impr
CVE-2026-86345 CRITICAL
9.0 Oct 01

StartTLS handling in 389-ds-base does not discard plaintext bytes buffered before the TLS upgrade, allowing an on-path a
CVE-2016-0741 HIGH
7.5 Apr 19

slapd/connection.c in 389 Directory Server (formerly Fedora Directory Server) 1.3.4.x before 1.3.4.7 allows remote attac
CVE-2015-1854 HIGH
7.5 Sep 19

389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entrie
CVE-2015-3230 HIGH
7.5 Oct 29

389 Directory Server (formerly Fedora Directory Server) before 1.3.3.12 does not enforce the nsSSL3Ciphers preference wh
CVE-2026-9064 HIGH
7.5 May 20

Denial of service in 389-ds-base LDAP server allows remote unauthenticated attackers to exhaust CPU and heap memory by s
CVE-2022-1949 HIGH
7.5 Jun 02

An access control bypass vulnerability found in 389-ds-base. Rated high severity (CVSS 7.5), this vulnerability is remot
CVE-2019-10171 HIGH
7.5 Aug 02

It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied i
CVE-2019-3883 HIGH
7.5 Apr 17

In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Rated high severity (CVSS 7.5), this vuln

Same weakness CWE-230 – Improper Handling of Missing Values

View all
CVE-2024-11024 CRITICAL
9.8
CVE-2024-10508 CRITICAL
9.8
CVE-2026-20086 HIGH
8.6
CVE-2024-0048 HIGH
7.8
CVE-2024-9781 HIGH
7.5
CVE-2026-25659 HIGH
7.1
CVE-2026-25658 HIGH
7.1
CVE-2025-23225 MEDIUM
6.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

References

Advisories & patches
ADVISORY https://access.redhat.com/security/cve/CVE-2024-6237 REF https://access.redhat.com/errata/RHSA-2024:4997 REF https://access.redhat.com/errata/RHSA-2024:5192 REF https://bugzilla.redhat.com/show_bug.cgi?id=2293579 REF https://github.com/389ds/389-ds-base/issues/5989

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy