CVE-2017-14623
In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function call to determine whether a user is authorized (i.e., a nil return value is interpreted as successful authorization) and (2) it is used with an LDAP server allowing unauthenticated bind.
- Score
- CVSS 3.1 8.1 High
- Status
- Modified - cve@mitre.org
- Published
- 2017-09-20
- Last modified
- 2024-09-17
- Weaknesses
- CWE-287
Affected products
References
- https://github.com/go-ldap/ldap/commit/95ede1266b237bf8e9aa5dce0b3250e51bfefe66
- https://github.com/go-ldap/ldap/pull/126
