CVE-2017-8028

In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take effect.

• CWE-287

• https://access.redhat.com/errata/RHSA-2018:0319
• https://lists.debian.org/debian-lts-announce/2017/11/msg00026.html
• https://pivotal.io/security/cve-2017-8028Issue Tracking, Vendor Advisory
• https://www.debian.org/security/2017/dsa-4046Issue Tracking, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2021.html
• https://access.redhat.com/errata/RHSA-2018:0319
• https://lists.debian.org/debian-lts-announce/2017/11/msg00026.html
• https://pivotal.io/security/cve-2017-8028Issue Tracking, Vendor Advisory
• https://www.debian.org/security/2017/dsa-4046Issue Tracking, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2021.html

Published

Nov 27, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-8022An issue was discovered in EMC NetWorker (prior to 8.2.4.9, …
• CVE-2017-8023EMC NetWorker may potentially be vulnerable to an unauthenti…9.8
• CVE-2017-8024EMC Isilon OneFS (versions prior to 8.1.0.1, versions prior …
• CVE-2017-8025RSA Archer GRC Platform prior to 6.2.0.5 is affected by an a…
• CVE-2017-8026Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-8027Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-8029Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-8030Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-8031An issue was discovered in Cloud Foundry Foundation cf-relea…5.3
• CVE-2017-8032In Cloud Foundry cf-release versions prior to v264; UAA rele…
• CVE-2017-8033An issue was discovered in the Cloud Controller API in Cloud…7.8
• CVE-2017-8034The Cloud Controller and Router in Cloud Foundry (CAPI-relea…