Authentication Bypass in Zend Framework Components from Zend

CVE-2014-8088

What is CVE-2014-8088?

The Zend Framework contains a vulnerability in the Zend_Ldap class and component, which permits remote attackers to bypass authentication mechanisms. This is achieved when a password begins with a null byte, resulting in an unauthenticated bind. This loophole could potentially enable malicious actors to gain unauthorized access to systems that rely on vulnerable versions of the framework.

References