CVE-2015-3250 Exposure of Sensitive Information to an Unauthorized Actor in Apache Directory LDAP API
Attackers can conduct timing attacks to potentially disclose sensitive information via unspecified vectors in the Apache Directory LDAP API library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-3250?
CVE-2015-3250 is a high-severity vulnerability in n/a, published on 7 Sep 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors.
Weakness: CWE-200
Which versions are affected by CVE-2015-3250?
2 open source packages ship an affected version, including org.apache.directory.api:api-ldap-model. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.directory.api:api-ldap-model Maven | All versions | 1.0.0-M31 |
org.apache.directory.api:api-ldap-model Maven | All versions | 1.0.0-M31 |
Products include Apache Directory Ldap Api.
How do I fix CVE-2015-3250?
Upgrade org.apache.directory.api:api-ldap-model to 1.0.0-M31 or later.
Is CVE-2015-3250 being exploited?
There is no known exploitation of CVE-2015-3250 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2015-3250, GHSA-cx3q-cv6w-mx4h, UBUNTU-CVE-2015-3250.