Homepage

org.springframework.ldap:spring-ldap-core@3.3.7

  • latest version

    4.0.3

  • latest non vulnerable version

    4.1.0-RC1

  • first published

    17 years ago

  • latest version published

    2 months ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.springframework.ldap:spring-ldap-core package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Incorrect Implementation of Authentication Algorithm

    org.springframework.ldap:spring-ldap-core is a maven plugin for LDAP for Sping.

    Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm via LDAP authentication handling in DirContextAuthenticationStrategy implementations. An attacker can bypass password verification by authenticating with a valid username and an empty or null password when the underlying LDAP server permits unauthenticated binds. Because there is no rejection for such bind requests, authentication may succeed without proof of knowledge of the user's password.

    Note:

    1)This affects authentication flows using AbstractContextSource, LdapTemplate, and LdapClient.

    1. This is only exploitable if the target LDAP server permits unauthenticated binds as defined in RFC 4513 Section 5.1.2.

    How to fix Incorrect Implementation of Authentication Algorithm?

    Upgrade org.springframework.ldap:spring-ldap-core to version 3.0.0, 3.3.8, 4.0.4 or higher.

    [2.4.0,3.0.0)[3.2.0,3.3.8)[4.0.0-M1,4.0.4)
    Go back to all versions of this package