| Package | Affected versions | Patched versions |
|---|---|---|
| phpwiki | ≤ 1.3.13 |
lib/WikiUser/LDAP.php in PhpWiki before 1.3.13p1, when the configuration lacks a nonzero PASSWORD_LENGTH_MINIMUM, might allow remote attackers to bypass authentication via an empty password, which causes ldap_bind to return true when used with certain LDAP implementations.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free