CVEvulnerability

CVE-2017-8028

8.1 HIGH Published 2017-11-27 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-11-27
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
8.1 HIGH — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
5.1 MEDIUM — AV:N/AC:H/Au:N/C:P/I:P/A:P
Weaknesses
CWE-287

Description

In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take effect.

Affected configurations

• pivotal software spring-ldap 1.3.0 • pivotal software spring-ldap 1.3.1 • pivotal software spring-ldap 1.3.2 • pivotal software spring-ldap 2.0.0 • pivotal software spring-ldap 2.0.1 • pivotal software spring-ldap 2.0.2 • pivotal software spring-ldap 2.0.3 • pivotal software spring-ldap 2.0.4 • pivotal software spring-ldap 2.1.0 • pivotal software spring-ldap 2.2.0 • pivotal software spring-ldap 2.2.1 • pivotal software spring-ldap 2.3.0 • pivotal software spring-ldap 2.3.1 • debian debian linux 8.0

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References