VDB
CVE-2018-16857
CVE-2018-16857
PUBLISHED
CVSS 7.4 HIGH
Reported by redhat · Published November 28, 2018
Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords (to restrict brute forcing of passwords) in a window of more than 3 minutes may not watch for bad passwords at all. The primary risk from this issue is with regards to domains that have been upgraded from Samba 4.8 and earlier. In these cases the manual testing done to confirm an organisation's password policies apply as expected may not have been re-done after the upgrade.
Risk Scores
CVSS 3.0
7.4
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| [UNKNOWN] | samba | 4.9.3 |
| [UNKNOWN] | samba | 4.9.3 |
Timeline
- Nov 28, 2018 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Feb 28, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Nov 6, 2022 EPSS Score
- Mar 11, 2023 EPSS Score
- May 13, 2023 EPSS Score
References
- x_refsource_CONFIRM
- x_refsource_CONFIRM
- 106024 vdb-entryx_refsource_BID
- x_refsource_CONFIRM
- GLSA-202003-52 vendor-advisoryx_refsource_GENTOO