GitHub Advisoryadvisory · Maven

GHSA-gv9v-c375-hvmg Improper Authentication in Spring Security

HIGH Published 2022-05-13 Modified 2022-07-07 Official page ↗
Aliases
CVE-2014-0097
Ecosystem
Maven
Packages
org.springframework.security:spring-security-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-287
Reviewed
2022-07-07

Affected packages

• Maven org.springframework.security:spring-security-core: >= 3.2.0, < 3.2.2.RELEASE → fixed in 3.2.2.RELEASE • Maven org.springframework.security:spring-security-core: >= 3.1.0, < 3.1.5.RELEASE → fixed in 3.1.5.RELEASE

Description

The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password.

Related

Alias · CVE (1)

  • CVE-2014-0097 The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References