CVE-2017-8028

moderate-risk

Published 2017-11-27

In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take effect.

Do I need to act?

1.4% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.1/10 High

NETWORK / HIGH complexity

Affected Products (15)

Spring-Ldap

Debian Linux

Spring-Ldap

Affected Vendors

Pivotal Software Debian

References (10)

https://access.redhat.com/errata/RHSA-2018:0319

https://lists.debian.org/debian-lts-announce/2017/11/msg00026.html

Issue Tracking https://pivotal.io/security/cve-2017-8028

Issue Tracking https://www.debian.org/security/2017/dsa-4046

https://www.oracle.com/security-alerts/cpujan2021.html

https://access.redhat.com/errata/RHSA-2018:0319

https://lists.debian.org/debian-lts-announce/2017/11/msg00026.html

Issue Tracking https://pivotal.io/security/cve-2017-8028

Issue Tracking https://www.debian.org/security/2017/dsa-4046

https://www.oracle.com/security-alerts/cpujan2021.html

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 4/34 · Minimal

Exposure 18/34 · Moderate