Risk | Low |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2017-8028 |
CWE-ID | CWE-592 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Spring-LDPA Web applications / JS libraries |
Vendor | Pivotal |
Security Bulletin
This security bulletin contains one low risk vulnerability.
EUVDB-ID: #VU9424
Risk: Low
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-8028
CWE-ID:
CWE-592 - Authentication Bypass Issues
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass authentication on the target system.
The weakness exists due to some LDAP vendors require an explicit operation for the
LDAP bind to take effect. A remote attacker with knowledge of the username can authenticate with an arbitrary password when connected to some LDAP servers, when no additional attributes are
bound, and when using LDAP BindAuthenticator with
org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy
as the authentication strategy, and setting userSearch.
Update to version 2.3.2.
Spring-LDPA: 1.3.0 - 2.3.1
External linkshttp://pivotal.io/security/cve-2017-8028
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.