CVE-2014-0074 in Shiro
Summary
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.
Be aware that VulDB is the high quality source for vulnerability data.
Reservation
12/03/2013
Disclosure
10/06/2014
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 71835 | Apache Shiro improper authentication | 287 | Not defined | Official fix | CVE-2014-0074 |