CVE-2015-3250: Apache Directory LDAP API - Exposure of Sensitive Information
Summary
CVE-2015-3250: Exposure of Sensitive Information to an Unauthorized Actor in Apache Directory LDAP API. Affects org.apache.directory.api:api-ldap-model versions < 1.0.0-M31. Fixed in 1.0.0-M31. How to fix ↓
Also tracked for
- apache-directory-api · Debian:11
The same CVE-2015-3250 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache Directory LDAP API is a Java library that provides an API for interacting with LDAP servers. It is commonly used in Java applications to perform LDAP operations such as searching, adding, modifying, and deleting entries in LDAP directories. The API is designed to be easy to use and provides a high-level abstraction for LDAP operations. However, a vulnerability has been discovered in versions prior to 1.0.0-M31 that allows attackers to conduct timing attacks, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability in the Apache Directory LDAP API allows attackers to conduct timing attacks. A timing attack is a type of side-channel attack where an attacker measures the time it takes for a system to perform certain operations in order to gain information about the system's internal state. In this case, the timing attack can be used to infer sensitive information from the LDAP server, such as the existence of certain entries or the length of attribute values. This information can then be used by an attacker to further exploit the system or gain unauthorized access.
How To Fix
Latest published version: 2.1.9 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0-M31
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to a version of the Apache Directory LDAP API that includes the fix.
Conclusion
In conclusion, the Apache Directory LDAP API prior to version 1.0.0-M31 is vulnerable to an exposure of sensitive information through timing attacks. To mitigate this vulnerability, it is recommended to upgrade to the latest version of the API. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.apache.directory.api:api-ldap-model →
FAQ
The vulnerability allows attackers to conduct timing attacks, which can potentially expose sensitive information from the LDAP server. This information can be used by an attacker to further exploit the system or gain unauthorized access.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file and Vulert will analyze it to identify any vulnerable dependencies.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity.
There are no known exploits for this vulnerability at the moment. However, it is important to apply the fix as soon as possible to mitigate the risk.
You can find more information about this vulnerability in the CVE-2015-3250 advisory on the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-cx3q-cv6w-mx4h/GHSA-cx3q-cv6w-mx4h.json).
