Normally you would not be able to read that attribute value (just do a bind) without admin level privs. Also LDAP passwords are usually hashed. I guess the app

Normally you would not be able to read that attribute value (just do a bind) without admin level privs. Also LDAP passwords are usually hashed. I guess the app/server is quite badly configured, like having your app run as dba.