Read the docs
TI-2018-15786 Aliases CVE-2018-1000134GHSA-qwq9-8rpf-8mp7

UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to…

Priority MEDIUM 50CWE-521Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-521.

Summary

UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to commit 8471904a02438c03965d21367890276bc25fa5a6, where the issue was reported and fixed contains an Incorrect Access Control vulnerability in process function in SimpleBindRequest class doesn't check for empty password when running in synchronous mode. commit with applied fix https://github.com/pingidentity/ldapsdk/commit/8471904a02438c03965d21367890276bc25fa5a6#diff-f6cb23b459be1ec17df1da33760087fd that can result in Ability to impersonate any valid user. This attack appear to be exploitable via Providing valid username and empty password against servers that do not do additional validation as per https://tools.ietf.org/html/rfc4513#section-5.1.1. This vulnerability appears to have been fixed in after commit 8471904a02438c03965d21367890276bc25fa5a6.

Why it matters now

EPSS 0.04651 91st percentileScored 2026-11-07
Fix Fixed com.unboundid:unboundid-ldapsdk (Maven): 4.0.5Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.unboundid:unboundid-ldapsdk (Maven)1.1.0 to before 4.0.54.0.5Patch availableGHSA-qwq9-8rpf-8mp7
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.unboundid:unboundid-ldapsdk (Maven) Vendor— Affected 1.1.0 to before 4.0.5 Fixed in 4.0.5 Patch available GHSA-qwq9-8rpf-8mp7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pingidentity:ldapsdk:*:*:*:*:*:java:*:*1.1.0 – 4.0.5VulnerablePing Identity
  • cpe:2.3:a:pingidentity:ldapsdk:*:*:*:*:*:java:*:* Versions 1.1.0 – 4.0.5 Vulnerable ·Ping Identity

Remediation

  • Fix · GHSA-qwq9-8rpf-8mp7 com.unboundid:unboundid-ldapsdk (Maven) Fixed in 4.0.5 Advisory →

Red Hat 2 advisories

  • RHSA-2023:1334 Released 2023-03-20 · Red Hat rating Critical
    Red Hat Process Automation Manager 7.13.2 security update
    • RHPAM 7.13.1 async
  • RHSA-2018:1713 Released 2018-05-24 · Red Hat rating Moderate
    unboundid-ldapsdk security update
    • Red Hat Virtualization Manager 4.1 unboundid-ldapsdk-4.0.5-1.el7ev, unboundid-ldapsdk-javadoc-4.0.5-1.el7ev

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHPAM 7.13.1 asyncFixed RHSA-2023:1334
Red Hat Virtualization Manager 4.1Fixed RHSA-2018:1713

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1000134
  2. 2026-10-03 Alias added: GHSA-qwq9-8rpf-8mp7

References

Advisory 3

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences