Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind…
Priority MEDIUM 41CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- Partial Red Hat: 5 fixed, 1 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-287.
Summary
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.
Why it matters now
EPSS 0.05487 92nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 2 advisoriesRed Hat: 5 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:shiro:1.0.0:*:*:*:*:*:*:* | 1.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:shiro:1.1.0:*:*:*:*:*:*:* | 1.1.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:shiro:1.2.0:*:*:*:*:*:*:* | 1.2.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:shiro:1.2.1:*:*:*:*:*:*:* | 1.2.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:shiro:1.2.2:*:*:*:*:*:*:* | 1.2.2 | Vulnerable | Apache |
- cpe:2.3:a:apache:shiro:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:shiro:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·Apache
- cpe:2.3:a:apache:shiro:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Apache
- cpe:2.3:a:apache:shiro:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Apache
- cpe:2.3:a:apache:shiro:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·Apache
Remediation
Red Hat 2 advisories
- RHSA-2014:1369 Released 2014-10-09 · Red Hat rating ImportantFuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update
- Fuse ESB Enterprise 7.1.0
- Fuse MQ Enterprise 7.1.0
- Fuse Management Console 7.1.0
- RHSA-2014:1351 Released 2014-10-01 · Red Hat rating ImportantRed Hat JBoss Fuse/A-MQ 6.1.0 security update
- Red Hat JBoss A-MQ 6.1
- Red Hat JBoss Fuse 6.1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Will not fix |
| Fuse ESB Enterprise 7.1.0 | Fixed | RHSA-2014:1369 |
| Fuse MQ Enterprise 7.1.0 | Fixed | RHSA-2014:1369 |
| Fuse Management Console 7.1.0 | Fixed | RHSA-2014:1369 |
| Red Hat JBoss A-MQ 6.1 | Fixed | RHSA-2014:1351 |
| Red Hat JBoss Fuse 6.1 | Fixed | RHSA-2014:1351 |
Timeline
- 2026-10-02 Threatist record created from CVE-2014-0074
- 2026-10-03 Alias added: GHSA-9486-j794-vqc4
References
More Apache Shiro vulnerabilities
- TI-2016-03813 Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-13272 Improper authentication in Apache Shiro CVSS 3.1CRITICAL 9.8
- TI-2021-18132 Improper authentication in Apache Shiro CVSS 3.1CRITICAL 9.8
- TI-2022-14167 Authentication bypass in Apache Shiro CVSS 3.1CRITICAL 9.8
- TI-2020-09649 Improper authentication in Apache Shiro CVSS 3.1CRITICAL 9.8
- TI-2020-10910 Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass. CVSS 3.1HIGH 7.5
Sources
- CVE-2014-0074 · CVE Program
- CVE-2014-0074 · NVD
- FIRST EPSS
- GHSA-9486-j794-vqc4 · GitHub Advisory Database · CC BY 4.0
- CVE-2014-0074 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences