Lucene search

RedhatCVE-2014-3612

HistoryAug 24, 2015 - 2:59 p.m.

CVE-2014-3612

2015-08-2414:59:00

CWE-287

redhat

web.nvd.nist.gov

ldaploginmodule

apache activemq

authentication bypass

cve-2014-3612

java authentication

authorization service

jaas

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

9.7

Confidence

High

EPSS

0.009

Percentile

83.1%

JSON

The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.

Affected configurations

Nvd

Node

apacheactivemqMatch5.0.0

apacheactivemqMatch5.1.0

apacheactivemqMatch5.2.0

apacheactivemqMatch5.3.0

apacheactivemqMatch5.3.1

apacheactivemqMatch5.3.2

apacheactivemqMatch5.4.0

apacheactivemqMatch5.4.1

apacheactivemqMatch5.4.2

apacheactivemqMatch5.4.3

apacheactivemqMatch5.5.0

apacheactivemqMatch5.5.1

apacheactivemqMatch5.6.0

apacheactivemqMatch5.7.0

apacheactivemqMatch5.8.0

apacheactivemqMatch5.9.0

apacheactivemqMatch5.9.1

apacheactivemqMatch5.10.0

VendorProductVersionCPE
apacheactivemq5.0.0cpe:2.3:a:apache:activemq:5.0.0:*:*:*:*:*:*:*
apacheactivemq5.1.0cpe:2.3:a:apache:activemq:5.1.0:*:*:*:*:*:*:*
apacheactivemq5.2.0cpe:2.3:a:apache:activemq:5.2.0:*:*:*:*:*:*:*
apacheactivemq5.3.0cpe:2.3:a:apache:activemq:5.3.0:*:*:*:*:*:*:*
apacheactivemq5.3.1cpe:2.3:a:apache:activemq:5.3.1:*:*:*:*:*:*:*
apacheactivemq5.3.2cpe:2.3:a:apache:activemq:5.3.2:*:*:*:*:*:*:*
apacheactivemq5.4.0cpe:2.3:a:apache:activemq:5.4.0:*:*:*:*:*:*:*
apacheactivemq5.4.1cpe:2.3:a:apache:activemq:5.4.1:*:*:*:*:*:*:*
apacheactivemq5.4.2cpe:2.3:a:apache:activemq:5.4.2:*:*:*:*:*:*:*
apacheactivemq5.4.3cpe:2.3:a:apache:activemq:5.4.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	activemq	5.0.0	cpe:2.3:a:apache:activemq:5.0.0:::::::*
apache	activemq	5.1.0	cpe:2.3:a:apache:activemq:5.1.0:::::::*
apache	activemq	5.2.0	cpe:2.3:a:apache:activemq:5.2.0:::::::*
apache	activemq	5.3.0	cpe:2.3:a:apache:activemq:5.3.0:::::::*
apache	activemq	5.3.1	cpe:2.3:a:apache:activemq:5.3.1:::::::*
apache	activemq	5.3.2	cpe:2.3:a:apache:activemq:5.3.2:::::::*
apache	activemq	5.4.0	cpe:2.3:a:apache:activemq:5.4.0:::::::*
apache	activemq	5.4.1	cpe:2.3:a:apache:activemq:5.4.1:::::::*
apache	activemq	5.4.2	cpe:2.3:a:apache:activemq:5.4.2:::::::*
apache	activemq	5.4.3	cpe:2.3:a:apache:activemq:5.4.3:::::::*