Information disclosure in Apache Directory
Priority MEDIUM 50CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any information contained in this request (including the credentials when sending a BIND request).
Why it matters now
EPSS 0.05152 92nd percentileScored 2026-11-07
Fix Fixed org.apache.directory.api:apache-ldap-api (Maven): 1.0.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Directory | LDAP API prior to 1.0.2 | — | No fix listed | CNA |
| — | org.apache.directory.api:apache-ldap-api (Maven) | before 1.0.2 | 1.0.2 | Patch available | GHSA-cfw5-v7cw-69cw |
- Apache Directory VendorApache Affected LDAP API prior to 1.0.2 Fixed in — No fix listed CNA
- org.apache.directory.api:apache-ldap-api (Maven) Vendor— Affected before 1.0.2 Fixed in 1.0.2 Patch available GHSA-cfw5-v7cw-69cw
Remediation
- Fix · GHSA-cfw5-v7cw-69cw org.apache.directory.api:apache-ldap-api (Maven) Fixed in 1.0.2 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1337
- 2026-10-03 Alias added: GHSA-cfw5-v7cw-69cw
References
Advisory 2
Other 14
- [directory-dev] 20180710 [Annoucement] CVE-2018-1337 Plaintext Password Disclosure in Secured Channel
- [kafka-jira] 20200818 [jira] [Assigned] (KAFKA-10414) Upgrade api-util dependency - CVE-2018-1337
- [kafka-dev] 20200818 [jira] [Created] (KAFKA-10414) Upgrade api-util dependency - CVE-2018-1337
- [kafka-jira] 20200818 [jira] [Created] (KAFKA-10414) Upgrade api-util dependency - CVE-2018-1337
- [kafka-jira] 20200819 [jira] [Updated] (KAFKA-10414) Upgrade api-util dependency - CVE-2018-1337
- [kafka-jira] 20200824 [jira] [Resolved] (KAFKA-10414) Upgrade api-util dependency - CVE-2018-1337
- [kafka-dev] 20200824 [jira] [Resolved] (KAFKA-10414) Upgrade api-util dependency - CVE-2018-1337
- https://lists.apache.org/thread.html/d66081195e9a02ee7cc20fb243b60467d1419586eed28297d820768f@%3Cdev.directory.apache.org%3E
- https://lists.apache.org/thread.html/r0e645b3f6ca977dc60b7cec231215c59a9471736c2402c1fef5a0616@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r1815fb5b0c345f571c740e7a1b48d7477647edd4ffcf9d5321e69446@%3Cdev.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r1a258430d820a90ff9d4558319296cc517ff2252327d7b3546d16749@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r4da40aa50cfdb2158898f2bc6df81feec1d42c6a06db6537d5cc0496@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r55e74532e7f9e84ecfa56b4e0a50a5fe0ba6f7a76880520e4400b0d7@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r56b304fb9960c869995efbb31da3b9b7c6d53ee31f7f7048eb80434b@%3Cdev.kafka.apache.org%3E
More Apache Directory Ldap Api vulnerabilities
- TI-2015-02878 Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors. CVSS 3.0HIGH 7.5
- TI-2026-27670 Apache Directory LDAP API: LDAP client implementation does not verify if the server… CVSS 4.0HIGH 8.8
Sources
- CVE-2018-1337 · CVE Program
- CVE-2018-1337 · NVD
- FIRST EPSS
- GHSA-cfw5-v7cw-69cw · GitHub Advisory Database · CC BY 4.0
- CVE-2018-1337 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences