Threats tagged 'ghsa-3j37-vw7v-fxxw'

A vulnerability in Apache Shiro's DefaultLdapRealm allows authentication bypass when authentication caching is enabled. After a user logs in successfully once, subsequent logins for that user succeed with any password due to the default AllowAllCredentialsMatcher accepting any credentials. This affects all Apache Shiro versions through 3.0.0 when using DefaultLdapRealm or JndiLdapRealm with authenticationCachingEnabled set to true, which is not the default setting. The issue is fixed in version 3.0.1 and later.