Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2017-8028

Опубликовано: 27 нояб. 2017
Источник: nvd
CVSS3: 8.1
CVSS2: 5.1
EPSS Низкий

Описание

In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take effect.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:pivotal_software:spring-ldap:1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring-ldap:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring-ldap:1.3.1:rc1:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring-ldap:1.3.2:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring-ldap:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring-ldap:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring-ldap:2.0.2:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring-ldap:2.0.3:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring-ldap:2.0.4:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring-ldap:2.1.0:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring-ldap:2.2.0:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring-ldap:2.2.1:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring-ldap:2.3.0:*:*:*:*:*:*:*
cpe:2.3:a:pivotal_software:spring-ldap:2.3.1:*:*:*:*:*:*:*
Конфигурация 2
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

EPSS

Процентиль: 79%
0.01283
Низкий

8.1 High

CVSS3

5.1 Medium

CVSS2

Дефекты

CWE-287

Связанные уязвимости

ubuntu логотип

CVE-2017-8028

CVSS3: 8.1
ubuntu
около 8 лет назад

In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take effect.

redhat логотип

CVE-2017-8028

CVSS3: 7.4
redhat
больше 8 лет назад

In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take effect.

debian логотип

CVE-2017-8028

CVSS3: 8.1
debian
около 8 лет назад

In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some ...

github логотип

GHSA-pjqh-2jcc-5j84

CVSS3: 8.1
github
больше 3 лет назад

Improper Authentication in Pivotal Spring-LDAP

fstec логотип

BDU:2021-01068

CVSS3: 8.1
fstec
около 8 лет назад

Уязвимость LDAP модуля Java-фреймворка для обеспечения безопасности промышленных приложений Spring Security, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

EPSS

Процентиль: 79%
0.01283
Низкий

8.1 High

CVSS3

5.1 Medium

CVSS2

Дефекты

CWE-287