CVE-2014-0097

The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password.

Score

CVSS 3.0 7.3 High

Status

Modified - security_alert@emc.com

Published

2017-05-25

Last modified

2024-08-06

Weaknesses

CWE-287

Affected products

• Spring Security (Pivotal)
• Spring Security (Vmware)

References

• https://pivotal.io/security/cve-2014-0097
• https://www.oracle.com/security-alerts/cpuapr2022.html