high7.5
CVE-2014-0074
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) u…
Impact
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Shiro | Versions 1.0.0, 1.1.0, 1.2.0, 1.2.1, 1.2.2 |
Weakness classification
References
- NVD record
- CVE.org record
- http://rhn.redhat.com/errata/RHSA-2014-1351.html
- http://seclists.org/fulldisclosure/2014/Mar/22
- https://issues.apache.org/jira/browse/SHIRO-460
- http://rhn.redhat.com/errata/RHSA-2014-1351.html
- http://seclists.org/fulldisclosure/2014/Mar/22
- https://issues.apache.org/jira/browse/SHIRO-460