CVE-2007-3193 lib/WikiUser/LDAP.php in PhpWiki before 1.3.13p1, when the configuration lacks a nonzero PASSWORD_LENGTH_MINIMUM, might allow remote attackers to bypass authentication via an empty password, which cau...
HighCVSS 10.0
EPSS 3.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
lib/WikiUser/LDAP.php in PhpWiki before 1.3.13p1, when the configuration lacks a nonzero PASSWORD_LENGTH_MINIMUM, might allow remote attackers to bypass authentication via an empty password, which causes ldap_bind to return true when used with certain LDAP implementations.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpwiki | <= 1.3.13 | No fix listed |
References
- 37219 vdb-entry
- 25595 patch third-party-advisory vendor-advisory
- 26784 third-party-advisory
- 26880 third-party-advisory
- GLSA-200709-10 vendor-advisory
- sourceforge.net
- sourceforge.net
- DSA-1371 vendor-advisory
- ADV-2007-2144 vdb-entry
- phpwiki-ldap-security-bypass(34819) vdb-entry