Every CVESearch/Get API key

CVE-2014-4668

The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier,...

6.8 MediumFix available

CVE-2014-4668 is a medium vulnerability (CVSS 6.8) in Cherokee-project Cherokee, published July 2, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.84%, the 86th percentile. Fixed in cherokee 1.2.103-2.2.mga4.

What does this mean?
Severity
6.8 MediumCVSS 2.0, NVD
Exploit chance
2.84%EPSS, 86th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
1.2.103-2.2.mga4cherokee

Description

The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.

Exploit likelihood

2.84%Up 0.9 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cherokee
Mageia:4
before 1.2.103-2.2.mga4
1.2.103-2.2.mga4

What each source reports

NVD Score used6.8

The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.

Record
CVE-2014-4668
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-287
Updated
2026-11-02
CVE ListNo score

The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.

Record
CVE-2014-4668
Updated
2026-11-02
EUVDEUVD-2014-4590No score

The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.

Record
EUVD-2014-4590
Updated
2026-11-03
GitHub AdvisoriesGHSA-x6gj-r267-c9vwNo score

The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier,...

The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.

Record
GHSA-x6gj-r267-c9vw
Weakness
CWE-287
Updated
2026-11-02
OSVMGASA-2015-0181No score

Updated cherokee packages fix CVE-2014-4668

Updated cherokee packages fix security vulnerability:

The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password (CVE-2014-4668).

Record
MGASA-2015-0181
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 6 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open