VULNERABILITY INTELLIGENCE

CVE-2014-0074

CVSS score7.5 HIGH
EPSS probability5.49%
CISA KEVNot currently listed
Published2014-10-06
Last modified2026-06-17
CVSS vectorAV:N/AC:L/Au:N/C:P/I:P/A:P

Description

Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.

Weakness classification

  • CWE-287: Improper Authentication

Primary references