CVE-2008-5112 describes an information disclosure vulnerability in the LDAP server of Microsoft Active Directory in Windows 2000 SP4 and Server 2003 SP1/SP2. This flaw allows remote attackers to enumerate valid usernames by observing differing responses to failed LDAP bind attempts based on account existence and login permissions. With a CVSS score of 5.0, this vulnerability has a low attack complexity and no authentication required, potentially leading to partial confidentiality impact. While not listed in CISA's KEV catalog and with no Metasploit or Nuclei modules, exploit code for username enumeration is publicly available on ExploitDB, though there is minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
server_2003CPE matchmatch criteria | cpe:2.3:o:microsoft:windows:server_2003:sp1:*:*:*:*:*:* | ||
server_2003CPE matchmatch criteria | cpe:2.3:o:microsoft:windows:server_2003:sp2:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:microsoft:windows_2000:-:sp4:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:P/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.