CVE-2017-8028
Improper Authentication in Pivotal Spring-LDAP
Also known as GHSA-pjqh-2jcc-5j84
Published 8 y ago · modified 4 mo ago · JSON
Summary
In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take effect.
Exploit prediction (EPSS)
2.61% probability of exploitation in the next 30 days, higher than 85% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 5.1 | AV:N/AC:H/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.springframework.ldap:spring-ldap-core | >=1.3.0, <2.3.2 | 2.3.2 |
Affected products
- n/a Spring-LDAP Spring-LDAP versions 1.3.0 2.3.1
Classification
- Weakness
- CWE-287 Improper Authentication
References
- access.redhat.com /errata/RHSA-2018:0319 · vendor-advisory, x_refsource_REDHAT, x_transferred
- debian.org /security/2017/dsa-4046 · vendor-advisory, x_refsource_DEBIAN, x_transferred
- lists.debian.org /debian-lts-announce/2017/11/msg00026.html · mailing-list, x_refsource_MLIST, x_transferred
- oracle.com /security-alerts/cpujan2021.html · x_refsource_MISC, x_transferred
- pivotal.io /security/cve-2017-8028 · x_refsource_CONFIRM, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-8028 · advisory
- github.com /spring-projects/spring-ldap/commit/08e8ae289bbd1b581986c7238604a147119c1336 · web
- github.com /spring-projects/spring-ldap · package
Sources
- CVE List: CVE-2017-8028
- GitHub Advisory: GHSA-pjqh-2jcc-5j84
- NVD: CVE-2017-8028
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.