Detections
Analytics

SCA: security update for org.springframework.ldap:spring-ldap-core (GHSA-pjqh-2jcc-5j84)

high Tenable Self-Hosted Container Security Plugin ID 417573

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional
 attributes are bound, and when using LDAP BindAuthenticator with
 org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication
 strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username
 is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take
 effect. (CVE-2017-8028)

See Also

https://github.com/advisories/GHSA-pjqh-2jcc-5j84

Plugin Details

Severity: High

ID: 417573

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.12

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 5.1

Temporal Score: 3.8

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2017-8028

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/13/2022

Vulnerability Publication Date: 10/16/2017

Reference Information

CVE: CVE-2017-8028

BID: 101485

cwe: CWE-287