CVE-2014-0074 | BDVDB-2026-64668 Detail

Description#

Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://seclists.org/fulldisclosure/2014/Mar/22
https://issues.apache.org/jira/browse/SHIRO-460
http://rhn.redhat.com/errata/RHSA-2014-1351.html

Exploit#

No public exploit known

History#

Version 12014-10-06Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.