CVE-2014-0097

Published: May 25, 2017Modified: May 13, 2026

7.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability: 3.9 / Impact: 3.4

Source: NVD

Description

The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password.

Affected (8)

Products: Vmware: Spring Security

Vmware

1 product

Spring Security

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Vmware Spring Security	Version 3.1.0
Vmware Spring Security	Version 3.1.1
Vmware Spring Security	Version 3.1.2
Vmware Spring Security	Version 3.1.3
Vmware Spring Security	Version 3.1.4
Vmware Spring Security	Version 3.1.5
Vmware Spring Security	Version 3.2.0
Vmware Spring Security	Version 3.2.1

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (4)

https://pivotal.io/security/cve-2014-0097

Source: security_alert@emc.com

Vendor Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: security_alert@emc.com

https://pivotal.io/security/cve-2014-0097

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.