A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Java
Information Disclosure
NVD
CVSS 3.1
3.7
EPSS
0.4%
The Client secret is not checked when using the OAuth Password grant type. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Authentication Bypass
NVD
CVSS 4.0
2.3
EPSS
0.3%