CVE-2017-8028

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take effect.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	Spring-LDAP Spring-LDAP versions 1.3.0 2.3.1	Spring-LDAP Spring-LDAP versions 1.3.0 2.3.1

References

https://access.redhat.com/errata/RHSA-2018:0319
https://lists.debian.org/debian-lts-announce/2017/11/msg00026.html
https://pivotal.io/security/cve-2017-8028Issue Tracking, Vendor Advisory
https://www.debian.org/security/2017/dsa-4046Issue Tracking, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html
https://access.redhat.com/errata/RHSA-2018:0319
https://lists.debian.org/debian-lts-announce/2017/11/msg00026.html
https://pivotal.io/security/cve-2017-8028Issue Tracking, Vendor Advisory
https://www.debian.org/security/2017/dsa-4046Issue Tracking, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html

Timeline

Published: Nov 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-80315.3An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x versi CVE-2017-80326.6In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x versions CVE-2017-80337.8An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions prior to v1.35.0 and cf-release versio CVE-2017-80346.6The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, C CVE-2017-80357.5An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.35.0 and CVE-2017-80367.8An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release version 1.33.0 (only). The original fix for CVE CVE-2017-80377.5In Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.38.0 and cf-release versions after v244 and prior to v270, th CVE-2017-80388.8In Cloud Foundry Foundation Credhub-release version 1.1.0, access control lists (ACLs) enforce whether an authenticated user can perform an CVE-2017-80395.9An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator use CVE-2017-80406.5In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, an XXE (XML External Enti CVE-2017-80416.1In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, a user can execute a XSS CVE-2017-80446.1In Pivotal Single Sign-On for PCF (1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3), certain pages allow code to be injected