CVEvulnerability
CVE-2014-0074
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2014-10-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-287
Description
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.
Affected configurations
• apache shiro 1.0.0
• apache shiro 1.1.0
• apache shiro 1.2.0
• apache shiro 1.2.1
• apache shiro 1.2.2
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://rhn.redhat.com/errata/RHSA-2014-1351.html rhn.redhat.com
- http://seclists.org/fulldisclosure/2014/Mar/22 seclists.org
- https://issues.apache.org/jira/browse/SHIRO-460 Exploit, Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2014-1351.html rhn.redhat.com
- http://seclists.org/fulldisclosure/2014/Mar/22 seclists.org
- https://issues.apache.org/jira/browse/SHIRO-460 Exploit, Vendor Advisory