CVE-2014-3999

EUVD-2014-3930
The Horde_Ldap library before 2.0.6 for Horde allows remote attackers to bypass authentication by leveraging knowledge of the LDAP bind user DN.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 78%
Affected Products (NVD)
VendorProductVersion
hordehorde_ldap
𝑥
< 2.0.6
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
php-horde-ldap
bookworm
2.4.2-6
fixed
bullseye
2.4.2-4
fixed
sid
2.4.2-6
fixed
trixie
2.4.2-6
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
php-horde-ldap
artful
ignored
bionic
not-affected
cosmic
not-affected
disco
not-affected
lucid
dne
precise
dne
saucy
ignored
trusty
dne
utopic
ignored
vivid
ignored
wily
ignored
xenial
not-affected
yakkety
ignored
zesty
ignored
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2014/06/14/1
http://www.securityfocus.com/bid/68014
https://bugzilla.redhat.com/show_bug.cgi?id=1109628
https://github.com/horde/horde/commit/4c3e18f1724ab39bfef10c189a5b52036a744d55
https://marc.info/?l=horde-announce&m=140178644816474&w=2
http://www.openwall.com/lists/oss-security/2014/06/14/1
http://www.securityfocus.com/bid/68014
https://bugzilla.redhat.com/show_bug.cgi?id=1109628
https://github.com/horde/horde/commit/4c3e18f1724ab39bfef10c189a5b52036a744d55
https://marc.info/?l=horde-announce&m=140178644816474&w=2