{"id":"CVE-2014-9043","aliases":["EUVD-2014-8871","GHSA-rj3c-33c5-42hm","openSUSE-SU-2024:10104-1"],"status":"published","title":"The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before...","description":"The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01859,"percentile":0.79357,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2015-02-04T18:00:00Z","modified":"2026-06-17T00:17:42Z","affected":[{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"znc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-2.6"}]}],"bundled":2}],"products":[{"vendor":"owncloud","product":"owncloud"},{"vendor":"owncloud","product":"owncloud_server"}],"references":[{"url":"https://owncloud.org/security/advisory/?id=oc-sa-2014-020","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9043"},{"url":"https://github.com/advisories/GHSA-rj3c-33c5-42hm"},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9043","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-9043","description":"The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind.","status":"published","published":"2015-02-04T18:00:00Z","modified":"2024-08-06T13:33:13.536Z","updated_at":"2026-11-02T14:33:42.882687Z"}],"euvd":[{"id":"EUVD-2014-8871","description":"The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind.","status":"published","published":"2015-02-04T18:00:00Z","modified":"2024-08-06T13:33:13Z","updated_at":"2026-11-03T01:56:50.141542Z"}],"ghsa":[{"id":"GHSA-rj3c-33c5-42hm","title":"The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before...","description":"The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind.","status":"published","published":"2022-05-17T04:16:31Z","modified":"2023-01-28T05:01:28Z","cwes":["CWE-287"],"updated_at":"2026-11-02T14:43:34.176707Z"}],"nvd":[{"id":"CVE-2014-9043","description":"The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind.","status":"published","published":"2015-02-04T18:59:03.62Z","modified":"2026-06-17T00:17:42.927Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:02:58.385843Z"}],"osv":[{"id":"openSUSE-SU-2024:10104-1","title":"znc-1.6.3-2.6 on GA media","description":"These are all security issues fixed in the znc-1.6.3-2.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:22:10.714573Z","updated_at":"2026-11-02T16:58:33.135986Z"}]}}