CVE-2014-0074

Опубликовано: 06 окт. 2014

Источник: nvd

CVSS2: 7.5

EPSS Низкий

Описание

Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.

Ссылки

http://rhn.redhat.com/errata/RHSA-2014-1351.html
http://seclists.org/fulldisclosure/2014/Mar/22
https://issues.apache.org/jira/browse/SHIRO-460
Exploit
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-1351.html
http://seclists.org/fulldisclosure/2014/Mar/22
https://issues.apache.org/jira/browse/SHIRO-460
Exploit
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:shiro:1.0.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:shiro:1.1.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:shiro:1.2.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:shiro:1.2.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:shiro:1.2.2:*:*:*:*:*:*:*

EPSS

Процентиль: 92%

0.05487

Низкий

7.5 High

CVSS2

Дефекты

CWE-287

Связанные уязвимости

CVE-2014-0074

redhat

больше 12 лет назад

Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.

CVE-2014-0074

debian

почти 12 лет назад

Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthen ...

GHSA-9486-j794-vqc4

github

около 4 лет назад

Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.

EPSS

Процентиль: 92%

0.05487

Низкий

7.5 High

CVSS2

Дефекты

CWE-287