Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2019-13565

27
FAUCET Score

CVE-2019-13565 is a high-severity vulnerability in OpenLDAP 2.x before 2.4.48, affecting products from vendors like Apple, Canonical, and Oracle. It allows unauthorized access to data by retaining SASL session encryption values for subsequent non-SASL connections, bypassing configured access controls. With a CVSS score of 7.5, this network-exploitable flaw could lead to full confidentiality compromise. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
>= 2.0, <= 2.4.47CPE matchmatch criteria
cpe:2.3:a:openldap:openldap:*:*:*:*:*:*:*:*
12.04CPE matchmatch criteria
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
14.04CPE matchmatch criteria
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
16.04CPE matchmatch criteria
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
18.04CPE matchmatch criteria
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
5.01%
Probability of exploitation in next 30 days
EPSS Percentile
91.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0502 is in the 85th percentile among its peer group of 51,551 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (3)

mediatekpatch availablevia llm_extracted
Fixed in: 9.3.1, 9.2.3, 9.1.6
oraclepatch availablevia nvd_reference
View patch
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: openldap

Vendor Advisories (2)

mediatekllm-mediatek-5bd731d14163992dHIGH

Third-Party Package Updates in Splunk Enterprise - October 2024

Oct 14, 2024
redhatCVE-2019-13565Moderate

openldap: ACL restrictions bypass due to sasl_ssf value being set permanently

Jul 24, 2019

References

lists.opensuse.org / opensuse-security-announce/2019-09/msg00053.html
Mailing ListThird Party Advisory
lists.opensuse.org / opensuse-security-announce/2019-09/msg00058.html
Mailing ListThird Party Advisory
seclists.org / fulldisclosure/2019/Dec/26
Mailing ListThird Party Advisory
lists.apache.org / thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
lists.apache.org / thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
lists.apache.org / thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
lists.debian.org / debian-lts-announce/2019/08/msg00024.html
Mailing ListThird Party Advisory
seclists.org / bugtraq/2019/Dec/23
Mailing ListThird Party Advisory
support.apple.com / kb/HT210788
Third Party Advisory
support.f5.com / csp/article/K98008862
usn.ubuntu.com / 4078-1
Third Party Advisory
usn.ubuntu.com / 4078-2
Third Party Advisory
openldap.org / its/index.cgi
Mailing ListVendor Advisory
openldap.org / lists/openldap-announce/201907/msg00001.html
Mailing ListVendor Advisory
oracle.com / security-alerts/cpuapr2020.html
PatchThird Party Advisory
oracle.com / security-alerts/cpuapr2022.html
PatchThird Party Advisory