VYPR
Get started
← All advisories
Unrated severityNVD Advisory· Published Oct 6, 2014· Updated May 6, 2026

CVE-2014-0074

CVE-2014-0074

Description

Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.

Affected products

5
  • Apache/Shiro5 versions
    cpe:2.3:a:apache:shiro:1.0.0:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:apache:shiro:1.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:shiro:1.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:shiro:1.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:shiro:1.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:shiro:1.2.2:*:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

3

News mentions

0

No linked articles in our index yet.