PT-2014-3465 · Apache · Apache Shiro

Publicado 2014-10-06 · Atualizado 2014-10-07 · CVE-2014-0074

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Shiro versions 1.x before 1.2.3

Description The issue allows remote attackers to bypass authentication when using an LDAP server with unauthenticated bind enabled. This can be achieved by providing an empty username or password.

Recommendations For versions prior to 1.2.3, update to version 1.2.3 or later to resolve the issue. As a temporary workaround, consider disabling the use of unauthenticated bind with the LDAP server until the update is applied. Restrict access to the LDAP authentication mechanism to minimize the risk of exploitation.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2014-0074

Produtos afetados

Apache Shiro

Referências · 7

• 🔥 https://issues.apache.org/jira/browse/SHIRO-460 · Exploit
• http://rhn.redhat.com/errata/RHSA-2014-1351.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0074 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-0074 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-0074 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-0074 · Nota de Segurança
• http://seclists.org/fulldisclosure/2014/Mar/22 · Nota