Published: 27/11/2017 Updated: 20/01/2021

CVSS v2 Base Score: 5.1 | Impact Score: 6.4 | Exploitability Score: 4.9

CVSS v3 Base Score: 8.1 | Impact Score: 5.9 | Exploitability Score: 2.2

VMScore: 454

Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P

In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take effect.

Vulnerable Product	Search on Vulmon	Subscribe to Product
pivotal software spring-ldap 2.3.0
pivotal software spring-ldap 2.3.1
pivotal software spring-ldap 2.0.2
pivotal software spring-ldap 2.0.1
pivotal software spring-ldap 2.2.1
pivotal software spring-ldap 2.0.0
pivotal software spring-ldap 1.3.2
pivotal software spring-ldap 2.0.4
pivotal software spring-ldap 2.0.3
pivotal software spring-ldap 1.3.0
pivotal software spring-ldap 2.2.0
pivotal software spring-ldap 2.1.0
pivotal software spring-ldap 1.3.1
debian debian linux 8.0

Synopsis Important: Red Hat JBoss Fuse/A-MQ 63 R6 security and bug fix update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerabi ...

Tobias Schneider discovered that libspring-ldap-java, a Java library for Spring-based applications using the Lightweight Directory Access Protocol, would under some circumstances allow authentication with a correct username but an arbitrary password For the oldstable distribution (jessie), this problem has been fixed in version 131RELEASE-5+deb ...

A vulnerability was found in spring-ldap that allows an attacker to authenticate with an arbitrary password When spring-ldap connected to some LDAP servers, when no additional attributes are bound, when using LDAP BindAuthenticator with orgspringframeworkldapcoresupportDefaultTlsDirContextAuthenticationStrategy as the authentication strategy, ...

CWE-287 https://pivotal.io/security/cve-2017-8028 https://www.debian.org/security/2017/dsa-4046 https://lists.debian.org/debian-lts-announce/2017/11/msg00026.html https://access.redhat.com/errata/RHSA-2018:0319 https://www.oracle.com/security-alerts/cpujan2021.html https://access.redhat.com/errata/RHSA-2018:0319 https://www.debian.org/security/./dsa-4046 https://nvd.nist.gov

CVE-2017-8028

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect