Jahia Null Password LDAP Authentication Bypass Vulnerability
BID:5684
Info
Jahia Null Password LDAP Authentication Bypass Vulnerability
| Bugtraq ID: | 5684 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 09 2002 12:00AM |
| Updated: | Sep 09 2002 12:00AM |
| Credit: | This issue was publicized in the changelog for the product. |
| Vulnerable: |
Jahia Jahia 3.1.1 Jahia Jahia 3.1 |
| Not Vulnerable: |
Jahia Jahia 3.1.2 |
Discussion
Jahia Null Password LDAP Authentication Bypass Vulnerability
The Jahia Content Management System and Web Portal software is prone to an issue which may enable remote attackers to login via LDAP authentication using a null or blank password.
This may allow remote attackers with knowledge of valid usernames to gain unauthorized access to Jahia accounts.
The Jahia Content Management System and Web Portal software is prone to an issue which may enable remote attackers to login via LDAP authentication using a null or blank password.
This may allow remote attackers with knowledge of valid usernames to gain unauthorized access to Jahia accounts.
Exploit / POC
Jahia Null Password LDAP Authentication Bypass Vulnerability
There is no exploit code required.
There is no exploit code required.
Solution / Fix
Jahia Null Password LDAP Authentication Bypass Vulnerability
Solution:
This issue has been addressed in Jahia 3.1.2. However, it has been reported the issue may still be present for some users in some environments, depending on the particular configuration. Users should contact the vendor for further details about upgrading.
Solution:
This issue has been addressed in Jahia 3.1.2. However, it has been reported the issue may still be present for some users in some environments, depending on the particular configuration. Users should contact the vendor for further details about upgrading.