Description
The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.
Remediation
References
Related Vulnerabilities
Squid Exposure of Resource to Wrong Sphere Vulnerability (CVE-2022-41317)
WordPress Plugin All-In-One Security (AIOS)-Security and Firewall SQL Injection (3.8.7)
Jboss EAP Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability (CVE-2023-1108)
WordPress Plugin Gallery transformation SQL Injection (1.0)
Drupal Core 9.0.x Multiple Cross-Site Scripting Vulnerabilities (9.0.0 - 9.0.5)