CVE-2014-0074 High Severity Vulnerability detected by WhiteSource

[mend-bolt-for-github]

CVE-2014-0074 - High Severity Vulnerability

Vulnerable Library - shiro-core-1.2.0.jar

Apache Shiro is a powerful and flexible open-source security framework that cleanly handles authentication, authorization, enterprise session management, single sign-on and cryptography services.

path: /root/.m2/repository/org/apache/shiro/shiro-core/1.2.0/shiro-core-1.2.0.jar,2/repository/org/apache/shiro/shiro-core/1.2.0/shiro-core-1.2.0.jar

Library home page: http://shiro.apache.org/shiro-core/

Dependency Hierarchy:

• shiro-web-1.2.0.jar (Root Library)
  • ❌ shiro-core-1.2.0.jar (Vulnerable Library)

Found in HEAD commit: 23068bfa8fba8e934988efafc64fa2cf0fdb8462

Vulnerability Details

Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.

Publish Date: 2014-10-06

URL: CVE-2014-0074

CVSS 2 Score Details (7.5)

Base Score Metrics not available

---

Step up your Open Source Security Game with WhiteSource here