Unscored severity · published Oct 6, 2014
CVE-2014-0074
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2)…
–
CVSS
5.5%
EPSS
No
On KEV
Description
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.5% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SH
Shiro · Apache
1.0.0; 1.1.0; 1.2.0; 1.2.1; 1.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0074
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0074
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-1351.html
seclists.org
http://seclists.org/fulldisclosure/2014/Mar/22
Exploit
https://issues.apache.org/jira/browse/SHIRO-460
More from Shiro
9.8
CVE-2016-4437
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access…
9.8
CVE-2023-34478
Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web…
9.8
CVE-2022-40664
Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher
9.8
CVE-2022-32532
Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers
9.8
CVE-2021-41303
Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass