GHSA-gv9v-c375-hvmg CVE-2014-0097

Improper Authentication in Spring Security

High Maven

Severity: 7.3 / 10; High · CVSS 3.0
Exploit chance (EPSS): 1.21%; Chance of exploitation in the next 30 days. Higher than 68.42% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-287 Improper Authentication
Fix: 3.2.2.RELEASE; Upgrade org.springframework.security:spring-security-core to this version or later

Description

The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password.

Affected versions

Maven

Package	Vulnerable	Fixed in
org.springframework.security:spring-security-core	`>= 3.2.0, < 3.2.2.RELEASE`	`3.2.2.RELEASE`
org.springframework.security:spring-security-core	`>= 3.1.0, < 3.1.5.RELEASE`	`3.1.5.RELEASE`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

org.springframework.security:spring-security-core Maven → `3.2.2.RELEASE`

maven

<dependency><groupId>org.springframework.security</groupId><artifactId>spring-security-core</artifactId><version>3.2.2.RELEASE</version></dependency>

gradle

implementation("org.springframework.security:spring-security-core:3.2.2.RELEASE")

Severity breakdown

CVSS 3.0 7.3

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: Low

Weakness

CWE-287: Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

How to prevent it

Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2014-0097

Timeline

May 13, 2022 Published
Nov 8, 2023 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-vxf7-qj7q-83fh Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider	Low	Also affects org.springframework.security:spring-security-core
GHSA-x2wq-9x2f-fhj7 Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured	Medium	Also affects org.springframework.security:spring-security-core
GHSA-vqxh-445g-37fc Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide	Medium	Also affects org.springframework.security:spring-security-core
GHSA-8v5q-rhf3-jphm Spring Security annotation detection mechanism has authorization bypass	High	Also affects org.springframework.security:spring-security-core
GHSA-9pp5-9c7g-4r83 Spring Security authorization bypass for method security annotations on private methods	Critical	Also affects org.springframework.security:spring-security-core
GHSA-hh3m-g4qj-4835 Spring Security Vulnerable to Authorization Bypass via Security Annotations	Medium	Also affects org.springframework.security:spring-security-core
GHSA-q3v6-hm2v-pw99 Spring Framework has Authorization Bypass for Case Sensitive Comparisons	Medium	Also affects org.springframework.security:spring-security-core
GHSA-hmqf-wpq9-jq83 Spring Security Missing Authorization vulnerability	High	Also affects org.springframework.security:spring-security-core

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor