CVE-2014-0097 Improper Authentication in Spring Security
HighCVSS 7.3
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework.security/spring-security-core(Maven) | >= 3.2.0, <= 3.2.1.RELEASE | No fix listed |
| org.springframework.security/spring-security-core(Maven) | >= 3.1.0, <= 3.1.4.RELEASE | No fix listed |
| org.springframework.security/spring-security-core(Maven) | >= 3.2.0, < 3.2.2.RELEASE | 3.2.2.RELEASE |
| org.springframework.security/spring-security-core(Maven) | = 3.2.0.RELEASE | No fix listed |
| org.springframework.security/spring-security-core(Maven) | = 3.2.1.RELEASE | No fix listed |
| org.springframework.security/spring-security-core(Maven) | >= 3.1.0, < 3.1.5.RELEASE | 3.1.5.RELEASE |
| org.springframework.security/spring-security-core(Maven) | = 3.1.0.RELEASE | No fix listed |
| org.springframework.security/spring-security-core(Maven) | = 3.1.1.RELEASE | No fix listed |
| org.springframework.security/spring-security-core(Maven) | = 3.1.2.RELEASE | No fix listed |
| org.springframework.security/spring-security-core(Maven) | = 3.1.3.RELEASE | No fix listed |
| org.springframework.security/spring-security-core(Maven) | = 3.1.4.RELEASE | No fix listed |
| VMware spring security | = 3.1.0 | No fix listed |
| VMware spring security | = 3.1.1 | No fix listed |
| VMware spring security | = 3.1.2 | No fix listed |
| VMware spring security | = 3.1.3 | No fix listed |
| VMware spring security | = 3.1.4 | No fix listed |
| VMware spring security | = 3.1.5 | No fix listed |
| VMware spring security | = 3.2.0 | No fix listed |
| VMware spring security | = 3.2.1 | No fix listed |
| pivotal Spring Security | = 3.2.0 to 3.2.1 | No fix listed |
| pivotal Spring Security | = 3.1.0 to 3.1.5 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- pivotal.io vendor-advisory
- www.oracle.com
- github.com patch
- github.com patch
- github.com patch
- jira.springsource.org
- github.com
- Debian Security Tracker CVE-2014-0097 vendor-advisory