Description |
- |
In 389-ds-base before version 2.0.7, it was found that if an asterisk is imported as a password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This would allow an attacker to successfully authenticate as a user who's password was supposedly disabled. |
+ |
In 389-ds-base before version 2.0.7, it was found that if an asterisk is imported as a password hash, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This would allow an attacker to successfully authenticate as a user who's password was supposedly disabled. |
|