CVE-2014-0097
high
CVSS v3
7.3
CVSS v2
7.5
VIR risk
7.3
Description
The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password.
Predictions
Exploit likelihood
82%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2014-0097
Vendor advisory: security_alert@emc.com — https://pivotal.io/security/cve-2014-0097
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bookworm | fixed | 0 |
| debian | bullseye | fixed | 0 |
| debian | forky | fixed | 0 |
| debian | sid | fixed | 0 |
| debian | trixie | fixed | 0 |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Maven | org.springframework.security:spring-security-core | >=3.2.0,<3.2.2.RELEASE | 3.2.2.RELEASE |
| Maven | org.springframework.security:spring-security-core | >=3.1.0,<3.1.5.RELEASE | 3.1.5.RELEASE |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| vmware | spring_security | 3.1.0 | |
| vmware | spring_security | 3.1.1 | |
| vmware | spring_security | 3.1.2 | |
| vmware | spring_security | 3.1.3 | |
| vmware | spring_security | 3.1.4 | |
| vmware | spring_security | 3.1.5 | |
| vmware | spring_security | 3.2.0 | |
| vmware | spring_security | 3.2.1 | |
References
- https://pivotal.io/security/cve-2014-0097
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://nvd.nist.gov/vuln/detail/CVE-2014-0097
- https://github.com/spring-projects/spring-security/commit/7dbb8e777ece8675f3333a1ef1cb4d6b9be80395
- https://github.com/spring-projects/spring-security/commit/88559882e967085c47a7e1dcbc4dc32c2c796868
- https://github.com/spring-projects/spring-security/commit/a7005bd74241ac8e2e7b38ae31bc4b0f641ef973
- https://jira.springsource.org/browse/SEC-2500
- https://security-tracker.debian.org/tracker/CVE-2014-0097
CWEs
CWE-287
Verify integrity in audit chain (admin only). AS-IS.