Is CVE-2009-1073 being actively exploited?

CVE-2009-1073 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2009-1073?

CVE-2009-1073 has a CVSS 3.1 base score of 5.5 (MEDIUM).

CVE-2009-1073

MEDIUM · CVSS 5.5EPSS 1.1%EU EUVD

nss-ldapd before 0.6.8 uses world-readable permissions for the /etc/nss-ldapd.conf file, which allows local users to obtain a cleartext password for the LDAP server by reading the bindpw field.

Key facts

CVSS score: 5.5 (v3.1)
Severity: MEDIUM
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-732
EPSS score: 1.1% (65th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2009-1074)
Published: March 31, 2009
NVD last modified: June 16, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2009-1074 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.

View on the EU Vulnerability Database

Affected products

debian / debian linux
debian / nss-ldap

References

http://arthurenhella.demon.nl/viewvc/nss-ldapd/nss-ldapd/debian/libnss-ldapd.postinst?r1=795&r2=813(Broken Link, Exploit)
http://arthurenhella.demon.nl/viewvc/nss-ldapd/nss-ldapd/man/nss-ldapd.conf.5.xml?r1=805&r2=806(Broken Link)
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=520476(Mailing List, Patch)
http://ch.tudelft.nl/~arthur/nss-ldapd/news.html#20090322(Broken Link)
http://launchpad.net/bugs/cve/2009-1073(Third Party Advisory)
http://secunia.com/advisories/34523(Broken Link)
http://www.debian.org/security/2009/dsa-1758(Patch, Third Party Advisory)
http://www.openwall.com/lists/oss-security/2009/03/23/3(Mailing List)
http://www.openwall.com/lists/oss-security/2009/03/24/2(Mailing List)
http://www.openwall.com/lists/oss-security/2009/03/25/3(Mailing List)
http://www.openwall.com/lists/oss-security/2009/03/25/4(Mailing List)
http://www.securityfocus.com/bid/34211(Broken Link, Third Party Advisory, VDB Entry)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain