CVE-2017-8028

In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP…

published November 27, 2017

CVSS
—
EPSS
3%
Percentile
85.2
In the wild
Unconfirmed
What it is

In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take effect.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02606 · 85.2th percentile
Published
2017-11-27T10:00Z
EPSS history
Timeline
  • 27 NOV 10:00Z
    In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP…
    cvelistv5