{"cve":"CVE-2017-8028","nvd":{"published":"2017-11-27T10:29:00.720","modified":"2026-06-17T01:25:39.727","status":"Modified","description":"In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take effect.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1},"cwes":["CWE-287"],"references":["https://access.redhat.com/errata/RHSA-2018:0319","https://lists.debian.org/debian-lts-announce/2017/11/msg00026.html","https://pivotal.io/security/cve-2017-8028","https://www.debian.org/security/2017/dsa-4046","https://www.oracle.com/security-alerts/cpujan2021.html"],"products":["debian:debian_linux","pivotal_software:spring-ldap"],"source":"nvd","synced_at":"2026-10-19T20:47:01.408438353+00:00"},"epss":{"cve":"CVE-2017-8028","score":0.02606,"percentile":0.85384,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-pjqh-2jcc-5j84","url":"https://osv.dev/vulnerability/GHSA-pjqh-2jcc-5j84","summary":"Improper Authentication in Pivotal Spring-LDAP","modified":"2024-04-10T18:57:08.806686Z","packages":[{"ecosystem":"Maven","name":"org.springframework.ldap:spring-ldap-core","purl":"pkg:maven/org.springframework.ldap/spring-ldap-core","ranges":[">=1.3.0 <2.3.2"],"fixed":["2.3.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}