Security readout for executives and security teams
Plain-English summary
389-ds-base could answer LDAP bind attempts differently depending on whether a directory entry exists. An unauthenticated attacker could use that difference to learn valid LDAP entries. The sources describe information disclosure and reconnaissance risk, not system takeover or direct credential theft.
Executive priority
Treat this as a moderate directory privacy and reconnaissance issue. Prioritize remediation on internet-facing or broadly reachable LDAP services, especially where directory names reveal users or service accounts.
Technical view
CVE-2020-35518 is a CWE-200 issue in 389-ds-base authentication handling. During DN bind processing, responses differ for existing versus nonexistent DNs, enabling unauthenticated entry enumeration. The source bundle names 389-ds-base 2.0.3, 1.4.4.13, and 1.4.3.19 and references upstream commits, but provides no CVSS score.
Likely exposure
Exposure is likely limited to environments running affected 389-ds-base versions where LDAP bind services are reachable by untrusted users or networks. Risk increases when directory entries reveal employee, service account, or application identity information.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. The described attacker capability is unauthenticated checking of LDAP entry existence through differing bind responses. No source supports broader compromise, privilege escalation, or data extraction beyond enumeration.
Researcher notes
Evidence is limited to the CVE description, affected version statement, Red Hat Bugzilla, upstream issue, and commits. The bundle does not provide CVSS, detailed exploitability analysis, or a named fixed release. Avoid claiming active exploitation without new evidence.
Mitigation direction
- Check 389 Directory Server and Red Hat guidance for fixed packages.
- Upgrade affected 389-ds-base builds to vendor-supported fixed versions.
- Restrict LDAP bind access to trusted networks where feasible.
- Review directory exposure for sensitive DN naming patterns.
- Monitor authentication logs for unusual bind enumeration patterns.
Validation and detection
- Inventory systems running 389-ds-base and record package versions.
- Confirm whether LDAP bind endpoints are reachable from untrusted networks.
- Check vendor advisories or package changelogs for CVE-2020-35518 fixes.
- Review authentication logs for repeated failed DN bind attempts.
- Verify compensating network controls around directory services.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-35518 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://bugzilla.redhat.com/show_bug.cgi?id=1905565CVE reference · x_refsource_MISC
- https://github.com/389ds/389-ds-base/issues/4480CVE reference · x_refsource_MISC
- https://github.com/389ds/389-ds-base/commit/cc0f69283abc082488824702dae485b8eae938bcCVE reference · x_refsource_MISC
- https://github.com/389ds/389-ds-base/commit/b6aae4d8e7c8a6ddd21646f94fef1bf7f22c3f32CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.