| Package | Affected versions | Patched versions |
|---|---|---|
| cherokee | = 1.2.101= 1.2.102= 1.2.2= 1.2.98= 1.2.99≤ 1.2.103 |
The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free