Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2018-1000134

31
FAUCET Score

CVE-2018-1000134 is a critical Incorrect Access Control vulnerability in the UnboundID LDAP SDK (pingidentity ldapsdk) affecting versions between commits 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb and 8471904a02438c03965d21367890276bc25fa5a6. This flaw allows an unauthenticated attacker to impersonate any valid user by providing a legitimate username with an empty password, bypassing authentication on vulnerable LDAP servers that do not perform additional validation. With a CVSS score of 9.8 (Critical), the vulnerability poses a significant risk of complete compromise of confidentiality, integrity, and availability. While no public exploit code or active exploitation has been observed, and community discussion is minimal, the potential impact remains high.

Impacted Technologies

VendorProductVersion(s)CPE
>= 1.1.0, <= 4.0.5CPE matchmatch criteria
cpe:2.3:a:pingidentity:ldapsdk:*:*:*:*:*:java:*:*

CVSS Data

CVSS version used by this source: 3.0

9.8CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.0

Exploit Intelligence

EPSS Score
4.74%
Probability of exploitation in next 30 days
EPSS Percentile
90.9%
Percentile rank of EPSS score among Peer Group
As of 2026-07-24
Model: v2026.06.15
This CVE's current EPSS score of 0.0474 is in the 85th percentile among its peer group of 36,833 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (3)

mavenpatch availablevia ghsa
Product: com.unboundid:unboundid-ldapsdkFixed in: 4.0.5
redhatpatch availablevia redhat_api
Product: Red Hat Virtualization Engine 4.1Fixed in: unboundid-ldapsdk-0:4.0.5-1.el7ev
View patch
redhatpatch availablevia redhat_api
Product: RHPAM 7.13.1 asyncFixed in: unboundid-ldapsdk
View patch

Vendor Advisories (2)

mavenGHSA-qwq9-8rpf-8mp7critical

Weak Password Requirements in UnboundID LDAP SDK

May 13, 2022
redhatCVE-2018-1000134Moderate

unboundid-ldapsdk: Incorrect Access Control vulnerability in process function in SimpleBindRequest class

Mar 16, 2018

References

access.redhat.com / errata/RHSA-2018:1713
github.com / pingidentity/ldapsdk/issues/40
Third Party Advisory
securityfocus.com / bid/103458
Third Party AdvisoryVDB Entry