| Package | Affected versions | Patched versions |
|---|---|---|
| org.springframework.security:spring-security-core | ≥ 3.1.0, < 3.1.5.RELEASE≥ 3.2.0, < 3.2.2.RELEASE | 3.1.5.RELEASE3.2.2.RELEASE |
| spring security | = 3.1.0= 3.1.1= 3.1.2= 3.1.3= 3.1.4= 3.1.5= 3.2.0= 3.2.1 |
The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free