CVE-2018-10871

389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores passwords in plaintext format in their respective changelog files. An attacker with sufficiently high privileges, such as root or Directory Manager, can query these files in order to retrieve plaintext passwords.

• CWE-312
• CWE-312

• https://access.redhat.com/errata/RHSA-2019:3401
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10871Issue Tracking, Mitigation, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/08/msg00032.htmlMailing List, Third Party Advisory
• https://pagure.io/389-ds-base/issue/49789Issue Tracking, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:3401
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10871Issue Tracking, Mitigation, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/08/msg00032.htmlMailing List, Third Party Advisory
• https://pagure.io/389-ds-base/issue/49789Issue Tracking, Third Party Advisory

Published

Jul 18, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10866It was discovered that the /configuration view of redhat-cer…9.1
• CVE-2018-10867Files are accessible without restrictions from the /update/r…9.1
• CVE-2018-10868redhat-certification 7 does not properly restrict the number…7.5
• CVE-2018-10869redhat-certification does not properly restrict files that c…7.5
• CVE-2018-1087kernel KVM before versions kernel 4.16, kernel 4.16-rc7, ker…8
• CVE-2018-10870redhat-certification does not properly sanitize paths in rhc…9.8
• CVE-2018-10872A flaw was found in the way the Linux kernel handled excepti…6.5
• CVE-2018-10873A vulnerability was discovered in SPICE before version 0.14.…8.3
• CVE-2018-10874In ansible it was found that inventory variables are loaded …7.8
• CVE-2018-10875A flaw was found in ansible. ansible.cfg is read from the cu…7.8
• CVE-2018-10876A flaw was found in Linux kernel in the ext4 filesystem code…5
• CVE-2018-10877Linux kernel ext4 filesystem is vulnerable to an out-of-boun…7.3