{"id":"CVE-2017-14623","aliases":["AZL-40850","DEBIAN-CVE-2017-14623","EUVD-2022-1243","GHSA-x27w-qxhg-343v","GO-2022-0887","UBUNTU-CVE-2017-14623"],"status":"published","title":"Access Restriction Bypass in go-ldap","description":"In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function call to determine whether a user is authorized (i.e., a nil return value is interpreted as successful authorization) and (2) it is used with an LDAP server allowing unauthenticated bind.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01685,"percentile":0.77144,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2017-09-20T23:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Go","package":"github.com/go-ldap/ldap","fixed_in":["2.5.0","2.5.0+incompatible"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"vitess","fixed_in":["19.0.4-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"golang-github-go-ldap-ldap","fixed_in":["2.5.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"golang-github-go-ldap-ldap","fixed_in":["2.5.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-go-ldap-ldap","fixed_in":["2.5.1-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/go-ldap/ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"vitess","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.0.4-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-go-ldap-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-go-ldap-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-go-ldap-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-ldap/ldap","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.5.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-ldap/ldap","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.5.0+incompatible"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-github-go-ldap-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20150817.24.12f2865-1"]}],"products":[{"vendor":"go-ldap_project","product":"ldap"}],"references":[{"url":"https://github.com/go-ldap/ldap/pull/126","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix","web","report"]},{"url":"https://github.com/go-ldap/ldap/commit/95ede1266b237bf8e9aa5dce0b3250e51bfefe66","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-14623","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-x27w-qxhg-343v","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-14623","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-14623","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-14623","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-14623","description":"In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function call to determine whether a user is authorized (i.e., a nil return value is interpreted as successful authorization) and (2) it is used with an LDAP server allowing unauthenticated bind.","status":"published","published":"2017-09-20T23:00:00Z","modified":"2024-09-17T00:00:49.94Z","updated_at":"2026-11-02T14:33:12.267141Z"}],"euvd":[{"id":"EUVD-2022-1243","description":"In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function call to determine whether a user is authorized (i.e., a nil return value is interpreted as successful authorization) and (2) it is used with an LDAP server allowing unauthenticated bind.","status":"published","published":"2017-09-20T23:00:00Z","modified":"2024-09-17T00:00:49Z","updated_at":"2026-11-03T00:29:03.409164Z"}],"ghsa":[{"id":"GHSA-x27w-qxhg-343v","title":"Access Restriction Bypass in go-ldap","description":"In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function call to determine whether a user is authorized (i.e., a nil return value is interpreted as successful authorization) and (2) it is used with an LDAP server allowing unauthenticated bind.","status":"published","published":"2022-02-15T01:57:18Z","modified":"2024-04-22T19:05:52Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:37:44.335614Z"}],"nvd":[{"id":"CVE-2017-14623","description":"In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function call to determine whether a user is authorized (i.e., a nil return value is interpreted as successful authorization) and (2) it is used with an LDAP server allowing unauthenticated bind.","status":"published","published":"2017-09-20T23:29:00.247Z","modified":"2026-06-17T01:06:30.423Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.1,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:03:59.716532Z"}],"osv":[{"id":"AZL-40850","title":"CVE-2017-14623 affecting package vitess for versions less than 19.0.4-2","description":"In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function call to determine whether a user is authorized (i.e., a nil return value is interpreted as successful authorization) and (2) it is used with an LDAP server allowing unauthenticated bind.","status":"published","published":"2017-09-20T23:29:00Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:19.893001Z"},{"id":"CVE-2017-14623","description":"In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function call to determine whether a user is authorized (i.e., a nil return value is interpreted as successful authorization) and (2) it is used with an LDAP server allowing unauthenticated bind.","status":"published","published":"2017-09-20T23:29:00.247Z","modified":"2026-10-20T10:48:13.288829158Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.572713Z"},{"id":"DEBIAN-CVE-2017-14623","description":"In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function call to determine whether a user is authorized (i.e., a nil return value is interpreted as successful authorization) and (2) it is used with an LDAP server allowing unauthenticated bind.","status":"published","published":"2017-09-20T23:29:00.247Z","modified":"2026-09-01T20:03:44.166803528Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.801885Z"},{"id":"GHSA-x27w-qxhg-343v","title":"Access Restriction Bypass in go-ldap","description":"In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function call to determine whether a user is authorized (i.e., a nil return value is interpreted as successful authorization) and (2) it is used with an LDAP server allowing unauthenticated bind.","status":"published","published":"2022-02-15T01:57:18Z","modified":"2024-08-21T15:58:39.070062Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"UBUNTU-CVE-2017-14623","description":"In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function call to determine whether a user is authorized (i.e., a nil return value is interpreted as successful authorization) and (2) it is used with an LDAP server allowing unauthenticated bind.","status":"published","published":"2017-09-20T23:29:00Z","modified":"2025-10-24T04:46:31Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.122973Z"},{"id":"GO-2022-0887","title":"Access Restriction Bypass in go-ldap in github.com/go-ldap/ldap","description":"Access Restriction Bypass in go-ldap in github.com/go-ldap/ldap","status":"published","published":"2024-08-21T15:29:08Z","modified":"2026-03-03T04:52:24.648256Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}