Description

In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take effect.

Remediation

References

https://pivotal.io/security/cve-2017-8028

https://www.debian.org/security/2017/dsa-4046

https://lists.debian.org/debian-lts-announce/2017/11/msg00026.html

https://access.redhat.com/errata/RHSA-2018:0319

https://www.oracle.com/security-alerts/cpujan2021.html

Related Vulnerabilities

CVE-2021-3859 Vulnerability in maven package io.undertow:undertow-core

CVE-2020-2094 Vulnerability in maven package org.jenkins-ci.plugins:cloudbees-jenkins-advisor

CVE-2022-0613 Vulnerability in npm package urijs

CVE-2023-3635 Vulnerability in maven package com.squareup.okio:okio-jvm

CVE-2022-36059 Vulnerability in npm package matrix-js-sdk

Severity

Critical

Classification

CWE-287 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Issue Tracking Vendor Advisory Third Party Advisory