Skip to content
Fencer Vulns
critical 9.8

CVE-2018-1000134 json

Weak Password Requirements in UnboundID LDAP SDK

published 2018-03-16 8 y ago modified 2026-06-17 4 mo ago also GHSA-qwq9-8rpf-8mp7 , EUVD-2022-5048

cvss
9.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
4.7%
EPSS 4.7% chance of exploitation in 30 days, percentile 91%
public exploits
0
none known

Summary

UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to commit 8471904a02438c03965d21367890276bc25fa5a6, where the issue was reported and fixed contains an Incorrect Access Control vulnerability in process function in SimpleBindRequest class doesn't check for empty password when running in synchronous mode. commit with applied fix https://github.com/pingidentity/ldapsdk/commit/8471904a02438c03965d21367890276bc25fa5a6#diff-f6cb23b459be1ec17df1da33760087fd that can result in Ability to impersonate any valid user. This attack appear to be exploitable via Providing valid username and empty password against servers that do not do additional validation as per https://tools.ietf.org/html/rfc4513#section-5.1.1. This vulnerability appears to have been fixed in after commit 8471904a02438c03965d21367890276bc25fa5a6.

Patch / fix

  • maven com.unboundid:unboundid-ldapsdk 4.0.5
  • unboundid-ldapsdk rhev manager 4 4.0.5-1.el7ev
  • unboundid-ldapsdk-javadoc rhev manager 4 4.0.5-1.el7ev

red hat advisories RHSA-2018:1713

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1000134 updated cvss 7.0

unboundid-ldapsdk: Incorrect Access Control vulnerability in process function in SimpleBindRequest class

  • Red Hat Virtualization Manager 4.1 unboundid-ldapsdk 4.0.5-1.el7ev, unboundid-ldapsdk-javadoc 4.0.5-1.el7ev
    fixed: vendor fix RHSA-2018:1713
  • Red Hat RHPAM 7.13.1 async
    fixed: vendor fix RHSA-2023:1334

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

4.65% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven com.unboundid:unboundid-ldapsdk
>=1.1.0, <4.0.5
4.0.5

Classification

Weakness
  • CWE-521 Weak Password Requirements

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.