CyberRota Analysis
AI-GeneratedThe embedded UnboundID LDAP server in multiple versions of Spring Security is vulnerable due to the unconditional registration of an administrative credential, exposing it to all network interfaces. This flaw allows unauthorized access to sensitive data and potential manipulation of the LDAP server, posing a critical risk to applications utilizing affected versions. Organizations using Spring Security, especially those handling sensitive user information, should prioritize remediation to mitigate potential exploitation.
Original NVD Description
Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25
Related CVEs
Other vulnerabilities affecting the same vendor(s)