« Volver al listado

CVE-2014-0097

Estado: ModificadaAlta (7.3)—

The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Vmware — Spring Security

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-0097",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "Pivotal",
          "product": "Spring Security",
          "versions": [
            {
              "status": "affected",
              "version": "3.2.0 to 3.2.1"
            },
            {
              "status": "affected",
              "version": "3.1.0 to 3.1.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-05-25T17:29:00.160",
  "references": [
    {
      "url": "https://pivotal.io/security/cve-2014-0097",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://www.oracle.com/security-alerts/cpuapr2022.html",
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://pivotal.io/security/cve-2014-0097",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.oracle.com/security-alerts/cpuapr2022.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password."
    },
    {
      "lang": "es",
      "value": "El ActiveDirectoryLdapAuthenticator en Spring Security versiones de la 3.2.0 a la 3.2.1 y de la 3.1.0 a la 3.1.5 no chequea la longitud de la contraseña. Si el directorio permite enlaces anónimos entonces podría autenticar de forma incorrecta a un usuario que proporcionase una contraseña vacía."
    }
  ],
  "lastModified": "2026-06-17T00:02:15.563",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:spring_security:3.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "717CECB8-01C6-41B1-810B-23CFDB6E7FC4"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_security:3.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1FF656E2-CE4E-4E84-BA94-E20778B1A5DE"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_security:3.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90AA303B-99C8-4BBB-A832-0C84413AF941"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_security:3.1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64819EA6-4D21-4A69-90E7-CAEE78301CAA"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_security:3.1.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1D779B3-A540-4358-BE2F-D50990BC9181"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_security:3.1.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D0B3B08-151A-487F-BDC0-B14FBAF082FE"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_security:3.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EFD426B7-885E-4C37-BA39-9877BB10685F"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_security:3.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D32668E1-4839-474C-A97D-0A485BF3CE04"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}