CVE-2014-4668
No CVSS score yet. EPSS 2.8% chance of exploitation in the next 30 days.
The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.
- EPSS
- 2.8% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- cherokee-project:cherokee
- fedoraproject:fedora
- mageia_project:mageia
References
- http://advisories.mageia.org/MGASA-2015-0181.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155776.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156162.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156190.html
- http://openwall.com/lists/oss-security/2014/06/28/3