CVE-2014-0097: High severity spring security vulnerability
The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0097?
CVE-2014-0097 has a medium severity rating due to its potential to allow unauthorized access through empty password authentication.
How do I fix CVE-2014-0097?
To fix CVE-2014-0097, upgrade Spring Security to version 3.2.2 or later where the password length check is properly implemented.
Which versions are affected by CVE-2014-0097?
CVE-2014-0097 affects Spring Security versions 3.1.0 to 3.1.5 and 3.2.0 to 3.2.1.
What can happen if I don't address CVE-2014-0097?
If CVE-2014-0097 is not addressed, an attacker may gain access by exploiting the directory's allowance for anonymous binds with an empty password.
Is there a workaround for CVE-2014-0097?
A possible workaround for CVE-2014-0097 is to disable anonymous binds in your LDAP configuration.