UnratedFix available
shiro — security advisory
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.
- Products
- shiro
- Affected versions
- Not specified
- Fixed versions
- 1.2.3-1
- CVEs
- CVE-2014-0074
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 21:44 UTC · Revision 1
Source evidence
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.
osv:DEBIAN-CVE-2014-0074
shiro
Fixed versions: 1.2.3-1
shiro
Fixed versions: 1.2.3-1
shiro
Fixed versions: 1.2.3-1
Complete source record
{
"id": "63f26c0bc3f6ca8a484aac9d1ccc1ff7e1361fe38d90b616e1787b31aea51d86",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2014-0074",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2014-0074",
"summary": "Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.",
"evidence": "osv:DEBIAN-CVE-2014-0074",
"products": [
{
"name": {
"value": "shiro",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.3-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "shiro",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.3-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "shiro",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.3-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2014-0074",
"aliases": [
"DEBIAN-CVE-2014-0074"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.3-1"
}
]
}
],
"package": {
"name": "shiro",
"purl": "pkg:deb/debian/shiro?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2014-0074.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.3-1"
}
]
}
],
"package": {
"name": "shiro",
"purl": "pkg:deb/debian/shiro?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2014-0074.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.3-1"
}
]
}
],
"package": {
"name": "shiro",
"purl": "pkg:deb/debian/shiro?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2014-0074.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T15:47:34.878732442Z",
"provider": "osv",
"upstream": [
"CVE-2014-0074"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2014-0074"
]
},
"related_cves": [
{
"value": "CVE-2014-0074",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 414285,
"published_at": "2014-10-06T14:55:08.063+00:00"
}