« Volver al listado

CVE-2014-4668

Estado: ModificadaMedia (6.8)—

The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Cherokee-project — CherokeeFedoraproject — FedoraMageia Project — Mageia

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-4668",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-07-02T04:14:17.233",
  "references": [
    {
      "url": "http://advisories.mageia.org/MGASA-2015-0181.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155776.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156162.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156190.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2014/06/28/3",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2014/06/28/7",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:225",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/68249",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/cherokee/webserver/commit/fbda667221c51f0aa476a02366e0cf66cb012f88",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://advisories.mageia.org/MGASA-2015-0181.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155776.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156162.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156190.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2014/06/28/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2014/06/28/7",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:225",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/68249",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/cherokee/webserver/commit/fbda667221c51f0aa476a02366e0cf66cb012f88",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password."
    },
    {
      "lang": "es",
      "value": "La función cherokee_validator_ldap_check en validator_ldap.c en Cherokee 1.2.103 y anteriores, cuando LDAP está utilizado, no considera debidamente la semántica bind no autenticada, lo que permite a atacantes remotos evadir autenticación a través de una contraseña vacía."
    }
  ],
  "lastModified": "2026-06-17T00:10:26.000",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF47C9F0-D8DA-4B55-89EB-9B2C9383ADB9"
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56BDB5A0-0839-4A20-A003-B8CD56F48171"
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "253C303A-E577-4488-93E6-68A8DD942C38"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:mageia_project:mageia:4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDB6C80D-ADCA-481E-B54B-3BEA3D7D3107"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cherokee-project:cherokee:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4AA7EA7-8D67-49E1-9D93-88CA97A8EFAC",
              "versionEndIncluding": "1.2.103"
            },
            {
              "criteria": "cpe:2.3:a:cherokee-project:cherokee:1.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D5B3C97-844D-4F58-87F4-11962A7228F2"
            },
            {
              "criteria": "cpe:2.3:a:cherokee-project:cherokee:1.2.98:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "762B5682-C942-4DC7-9C69-D0AC3D4E275C"
            },
            {
              "criteria": "cpe:2.3:a:cherokee-project:cherokee:1.2.99:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9FB62CE7-9FC9-4E7F-8B3D-45710949EA6A"
            },
            {
              "criteria": "cpe:2.3:a:cherokee-project:cherokee:1.2.101:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D33D414B-0A4C-41EE-991A-788559EC3A03"
            },
            {
              "criteria": "cpe:2.3:a:cherokee-project:cherokee:1.2.102:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1407BB70-8D64-422F-8487-4D8B3E88963E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}