The vulnerability in 389 Directory Server involves missing authorization checks on the CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations. When the nsslapd-allow-anonymous-access setting is enabled (default), unauthenticated attackers can invoke these operations remotely. If anonymous access is disabled, any authenticated user, regardless of privilege level, can still invoke these operations due to the lack of internal authorization checks. This allows attackers to remove replica IDs from replication metadata, purge changelog records, and interrupt administrator-initiated cleanup tasks, which may lead to replication inconsistencies or unavailability. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. Red Hat's advisory recommends setting nsslapd-allow-anonymous-access to rootdse or off as an interim mitigation and restricting replication LDAP ports to trusted networks. No official patch or fix has been published at this time.

An attacker able to reach the LDAP listener can invoke replication-maintenance operations without authorization, allowing removal of replica IDs from replication metadata, purging of changelog records, and interruption of cleanup processes. This can cause replication to become inconsistent or unavailable, impacting the integrity and availability of the directory service. The vulnerability does not impact confidentiality. The flaw affects both unauthenticated attackers (if anonymous access is enabled) and any authenticated user (if anonymous access is disabled).

Red Hat advises setting the nsslapd-allow-anonymous-access configuration to rootdse or off to block exploitation by unauthenticated clients. However, this does not prevent authenticated low-privilege users from exploiting the flaw. Therefore, restricting replication LDAP ports to trusted networks is recommended as a defense-in-depth measure. No official patch or fix is currently available; users should monitor the Red Hat advisory for updates.