CVE-2014-9043
The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before...
The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind.
Exploit likelihood
What each source reports
NVD Score used
The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind.
- Record
CVE-2014-9043- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind.
- Record
CVE-2014-9043- Updated
- 2026-11-02
EUVDEUVD-2014-8871 No score
The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind.
- Record
EUVD-2014-8871- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rj3c-33c5-42hm No score
The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before...
The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind.
- Record
GHSA-rj3c-33c5-42hm- Weakness
- CWE-287
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10104-1 No score
znc-1.6.3-2.6 on GA media
These are all security issues fixed in the znc-1.6.3-2.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10104-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zncopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 1.6.3-2.6 | 1.6.3-2.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9043 is a medium vulnerability (CVSS 5.0) in Owncloud, published February 4, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.86%, the 79th percentile. No source names a fixed version.