CVE-2014-0074

Опубликовано: 06 окт. 2014

Источник: nvd

CVSS2: 7.5

EPSS Низкий

Описание

Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.

Ссылки

http://rhn.redhat.com/errata/RHSA-2014-1351.html
http://seclists.org/fulldisclosure/2014/Mar/22
https://issues.apache.org/jira/browse/SHIRO-460
Exploit
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-1351.html
http://seclists.org/fulldisclosure/2014/Mar/22
https://issues.apache.org/jira/browse/SHIRO-460
Exploit
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:shiro:1.0.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:shiro:1.1.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:shiro:1.2.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:shiro:1.2.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:shiro:1.2.2:*:*:*:*:*:*:*

EPSS

Процентиль: 50%

0.00267

Низкий

7.5 High

CVSS2

Дефекты

CWE-287

Связанные уязвимости

CVE-2014-0074

redhat

почти 12 лет назад

Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.

CVE-2014-0074

debian

больше 11 лет назад

Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthen ...

GHSA-9486-j794-vqc4

github

больше 3 лет назад

Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.

EPSS

Процентиль: 50%

0.00267

Низкий

7.5 High

CVSS2

Дефекты

CWE-287