cve.bz

CVE-2014-0097

7.3 highEPSS 1.2%

High (7.3) in vmware spring security. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in org.springframework.security:spring-security-core 3.1.5.RELEASE, 3.2.2.RELEASE.

The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password.

Severity

CVSS 3.0

7.3 high
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS
1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-11-01)
CWE
CWE-287
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-gv9v-c375-hvmgMavenorg.springframework.security:spring-security-core>=3.2.0 <3.2.2.RELEASE3.2.2.RELEASE
GHSA-gv9v-c375-hvmgMavenorg.springframework.security:spring-security-core>=3.1.0 <3.1.5.RELEASE3.1.5.RELEASE

References

Check your stackJSON