CVE-2018-1337
Last modified
CVE-2018-1337 is a vulnerability of currently unknown severity. In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any information contained in this request (including the credentials when sending a BIND request).. EPSS estimates a 5.31% chance of exploitation in the next 30 days.
Description
In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any information contained in this request (including the credentials when sending a BIND request).
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Directory Ldap Api | < 1.0.2 |
References
- http://www.securityfocus.com/bid/104744Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/104744Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-1337?
How severe is CVE-2018-1337?
How do I fix CVE-2018-1337?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-13360Cross-site scripting in Text Editor in TerraMaster TOS versi…
- CVE-2018-13361User enumeration in usertable.php in TerraMaster TOS version…
- CVE-2018-13365An Information Exposure vulnerability in Fortinet FortiOS 6.…
- CVE-2018-13366An information disclosure vulnerability in Fortinet FortiOS …
- CVE-2018-13367An information exposure vulnerability in FortiOS 6.2.3, 6.2.…
- CVE-2018-13368A local privilege escalation in Fortinet FortiClient for Win…
- CVE-2018-13371An external control of system vulnerability in FortiOS may a…8.8
- CVE-2018-13372Rejected reason: Not used
- CVE-2018-13374A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 a…4.3
- CVE-2018-13375An Improper Neutralization of Script-Related HTML Tags in Fo…
- CVE-2018-13376An uninitialized memory buffer leak exists in Fortinet Forti…
- CVE-2018-13378An information disclosure vulnerability in Fortinet FortiSIE…
Are you affected by CVE-2018-1337?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST