Skip to content

01 Record

CVE-2016-6497

main/java/org/apache/directory/groovyldap/LDAP.java in the Groovy LDAP API in Apache allows attackers to conduct LDAP entry poisoning attacks by leveraging setting returnObjFlag to true for all search

UnratedPUBLISHEDCNA: hpe

CNA base scoreUnratedNo CNA CVSS vector

02 Description

main/java/org/apache/directory/groovyldap/LDAP.java in the Groovy LDAP API in Apache allows attackers to conduct LDAP entry poisoning attacks by leveraging setting returnObjFlag to true for all search

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 5.72% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 92.8% of scored records. A rank, not a probability.
NVD base score: 7.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2017-01-18 22:00Z9 YR AGO

Last updated

2024-08-06 01:29Z2 YR AGO

Reserved

2016-08-01

Assigning CNA

hpe

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-254
CWE-358Improperly Implemented Security Check for StandardBase

Data version

5.1

Document digest

61b0ac647fea4e31f1f649ba91e6b73c77b0a21b633b8f1f55d425321a587091

05 Affected products

VendorProductVersionsPlatforms

apachegroovy_ldapNot specified—

redhatenterprise_linuxNot specified—

redhatjboss_data_virtualizationNot specified—

redhatjboss_enterprise_application_platformNot specified—

redhatjboss_enterprise_brms_platformNot specified—

redhatjboss_enterprise_soa_platformNot specified—

redhatjboss_fuseNot specified—

redhatjboss_fuse_service_worksNot specified—

redhatjboss_operations_networkNot specified—

redhatopenshiftNot specified—

06 References

www.securityfocus.com95929http://www.securityfocus.com/bid/95929vdb-entryx_refsource_BID
www.blackhat.comhttps://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdfx_refsource_MISC
mail-archives.apache.org[directory-users] 20161029 Security vulnerability in Groovy LDAP APIhttps://mail-archives.apache.org/mod_mbox/directory-users/201610.mbox/%3Cb7d7e909-a8ed-1ab4-c853-4078c1e7624a%40stefan-seelmann.de%3Emailing-listx_refsource_MLIST
svn.apache.orghttp://svn.apache.org/viewvc/directory/sandbox/szoerner/groovyldap/src/main/java/org/apache/directory/groovyldap/LDAP.java?r1=1765362&r2=1765361&pathrev=1765362&view=patchx_refsource_CONFIRM
www.oracle.comhttps://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlx_refsource_MISC