CVE-2014-0074 Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.
HighCVSS 7.5
EPSS 5.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/shiro(Debian:12) | < 1.2.3-1 | 1.2.3-1 |
| debian/shiro(Debian:13) | < 1.2.3-1 | 1.2.3-1 |
| debian/shiro(Debian:14) | < 1.2.3-1 | 1.2.3-1 |
| apache shiro | = 1.0.0 | No fix listed |
| apache shiro | = 1.1.0 | No fix listed |
| apache shiro | = 1.2.0 | No fix listed |
| apache shiro | = 1.2.1 | No fix listed |
| apache shiro | = 1.2.2 | No fix listed |
References
- Debian Security Tracker CVE-2014-0074 vendor-advisory
- RHSA-2014:1351 vendor-advisory
- 20140303 [Announce] Apache Shiro 1.2.3 Released - Security Advisory mailing-list
- issues.apache.org exploit vendor-advisory