CVE-2014-3612

The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to…

published August 24, 2015

CVSS
—
EPSS
7%
Percentile
94.2
In the wild
Unconfirmed
What it is

The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.07181 · 94.2th percentile
Published
2015-08-24T14:00Z
EPSS history
Timeline
  • 24 AUG 14:00Z
    The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to…
    cvelistv5