{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-29T14:52:19.037","vulnerabilities":[{"cve":{"id":"CVE-2018-16860","sourceIdentifier":"secalert@redhat.com","published":"2019-07-31T15:15:11.687","lastModified":"2026-06-17T01:44:55.820","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up to, excluding 4.10.3, when used in AD DC mode. A man in the middle attacker could use this flaw to intercept the request to the KDC and replace the user name (principal) in the request with any desired user name (principal) that exists in the KDC effectively obtaining a ticket for that principal."},{"lang":"es","value":"Se encontró un fallo en la implementación de Heimdal KDC de samba, versiones 4.8.x hasta 4.8.12 excluyéndola, versiones 4.9.x hasta 4.9.8 excluyéndola, y versiones 4.10.x hasta 4.10.3 excluyéndola, cuando es usado en modo AD DC . Un atacante de tipo man in the middle podría usar este fallo para interceptar la petición al KDC y reemplazar el nombre de usuario (principal) en la petición con cualquier nombre de usuario (principal) deseado que exista en el KDC obteniendo efectivamente un ticket para este principal."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"SAMBA","product":"samba","versions":[{"version":"4.8.x up to, excluding 4.8.12","status":"affected"},{"version":"4.9.x up to, excluding 4.9.8","status":"affected"},{"version":"4.10.x up to, excluding 4.10.3","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:P/I:P/A:P","baseScore":6.0,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-358"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-358"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8.0","versionEndExcluding":"4.8.12","matchCriteriaId":"04E9BEFE-FF93-4C6F-B76D-6B8CFE1E5BDD"},{"vulnerable":true,"criteria":"cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.0","versionEndExcluding":"4.9.8","matchCriteriaId":"35DB3E08-0131-4AF2-AB27-D51B401D7D45"},{"vulnerable":true,"criteria":"cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10.0","versionEndExcluding":"4.10.3","matchCriteriaId":"895BEC8B-ADBC-4575-B07E-3149A613C4ED"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:heimdal_project:heimdal:*:*:*:*:*:*:*:*","versionStartIncluding":"0.8","versionEndIncluding":"7.5.0","matchCriteriaId":"683A4E25-64AF-46AC-BAA8-E56BD9C9840F"}]}]}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00026.html","source":"secalert@redhat.com"},{"url":"http://seclists.org/fulldisclosure/2019/Aug/11","source":"secalert@redhat.com"},{"url":"http://seclists.org/fulldisclosure/2019/Aug/13","source":"secalert@redhat.com"},{"url":"http://seclists.org/fulldisclosure/2019/Aug/14","source":"secalert@redhat.com"},{"url":"http://seclists.org/fulldisclosure/2019/Aug/15","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16860","source":"secalert@redhat.com","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://seclists.org/bugtraq/2019/Aug/21","source":"secalert@redhat.com"},{"url":"https://seclists.org/bugtraq/2019/Aug/22","source":"secalert@redhat.com"},{"url":"https://seclists.org/bugtraq/2019/Aug/23","source":"secalert@redhat.com"},{"url":"https://seclists.org/bugtraq/2019/Aug/25","source":"secalert@redhat.com"},{"url":"https://security.gentoo.org/glsa/202003-52","source":"secalert@redhat.com"},{"url":"https://support.apple.com/HT210346","source":"secalert@redhat.com"},{"url":"https://support.apple.com/HT210348","source":"secalert@redhat.com"},{"url":"https://support.apple.com/HT210351","source":"secalert@redhat.com"},{"url":"https://support.apple.com/HT210353","source":"secalert@redhat.com"},{"url":"https://www.samba.org/samba/security/CVE-2018-16860.html","source":"secalert@redhat.com","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.synology.com/security/advisory/Synology_SA_19_23","source":"secalert@redhat.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00026.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2019/Aug/11","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2019/Aug/13","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2019/Aug/14","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2019/Aug/15","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16860","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://seclists.org/bugtraq/2019/Aug/21","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://seclists.org/bugtraq/2019/Aug/22","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://seclists.org/bugtraq/2019/Aug/23","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://seclists.org/bugtraq/2019/Aug/25","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202003-52","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/HT210346","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/HT210348","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/HT210351","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/HT210353","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.samba.org/samba/security/CVE-2018-16860.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.synology.com/security/advisory/Synology_SA_19_23","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}