CVE-2019-13057

An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)

• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.htmlMailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2019/Dec/26Mailing List, Third Party Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10365Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/08/msg00024.htmlMailing List, Third Party Advisory
• https://seclists.org/bugtraq/2019/Dec/23Mailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20190822-0004/Third Party Advisory
• https://support.apple.com/kb/HT210788Third Party Advisory
• https://usn.ubuntu.com/4078-1/Third Party Advisory
• https://usn.ubuntu.com/4078-2/Third Party Advisory
• https://www.openldap.org/its/?findid=9038Mailing List, Vendor Advisory
• https://www.openldap.org/lists/openldap-announce/201907/msg00001.htmlMailing List, Product, Vendor Advisory
• https://www.oracle.com/security-alerts/cpuapr2020.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.htmlMailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2019/Dec/26Mailing List, Third Party Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10365Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/08/msg00024.htmlMailing List, Third Party Advisory
• https://seclists.org/bugtraq/2019/Dec/23Mailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20190822-0004/Third Party Advisory
• https://support.apple.com/kb/HT210788Third Party Advisory
• https://usn.ubuntu.com/4078-1/Third Party Advisory
• https://usn.ubuntu.com/4078-2/Third Party Advisory
• https://www.openldap.org/its/?findid=9038Mailing List, Vendor Advisory
• https://www.openldap.org/lists/openldap-announce/201907/msg00001.htmlMailing List, Product, Vendor Advisory
• https://www.oracle.com/security-alerts/cpuapr2020.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory

Published

Jul 26, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-13051Pi-Hole 4.3 allows Command Injection.8.8
• CVE-2019-13052Logitech Unifying devices allow live decryption if the pairi…
• CVE-2019-13053Logitech Unifying devices allow keystroke injection, bypassi…
• CVE-2019-13054The Logitech R500 presentation clicker allows attackers to d…
• CVE-2019-13055Certain Logitech Unifying devices allow attackers to dump AE…
• CVE-2019-13056An issue was discovered in CyberPanel through 1.8.4. On the …
• CVE-2019-1306A remote code execution vulnerability exists when Azure DevO…9.8
• CVE-2019-13063Within Sahi Pro 8.0.0, an attacker can send a specially craf…7.5
• CVE-2019-13066Sahi Pro 8.0.0 has a script manager arena located at _s_/dyn…6.1
• CVE-2019-13067njs through 0.3.3, used in NGINX, has a buffer over-read in …
• CVE-2019-13068public/app/features/panel/panel_ctrl.ts in Grafana before 6.…
• CVE-2019-13069extenua SilverSHielD 6.x fails to secure its ProgramData fol…