9.8

CVE-2018-1000134: pingidentity ldapsdk Weak Password Requirements

CVSS: 9.8v3.0CriticalModified
AliasesRHSA-2018:1713GHSA-qwq9-8rpf-8mp7
Published 16-03-2018Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2018-1000134 is a critical (CVSS 9.8) Weak Password Requirements vulnerability in pingidentity ldapsdk. EPSS estimates a 4.65% chance of exploitation in the next 30 days, higher than 91.6% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.0 (NVD)
EPSS score
4.65%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 16-03-2018
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to commit 8471904a02438c03965d21367890276bc25fa5a6, where the issue was reported and fixed contains an Incorrect Access Control vulnerability in process function in SimpleBindRequest class doesn't check for empty password when running in synchronous mode. commit with applied fix https://github.com/pingidentity/ldapsdk/commit/8471904a02438c03965d21367890276bc25fa5a6#diff-f6cb23b459be1ec17df1da33760087fd that can result in Ability to impersonate any valid user. This attack appear to be exploitable via Providing valid username and empty password against servers that do not do additional validation as per https://tools.ietf.org/html/rfc4513#section-5.1.1. This vulnerability appears to have been fixed in after commit 8471904a02438c03965d21367890276bc25fa5a6.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

4.65%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

0.00 pp

From 4.65% on 20-09-2026

20-09-202620-10-2026
EPSS score
4.65%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat2 products
  • unboundid-ldapsdk< 0:4.0.5-1.el7ev
  • unboundid-ldapsdk-javadoc< 0:4.0.5-1.el7ev
Com.unboundid1 product
  • unboundid-ldapsdk≥ 1.1.0, < 4.0.5
Pingidentity1 product

3 vendors · 4 products

References

13 links
Show all 13 references