CVE-2021-26117CWE-287

ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind

published January 27, 2021

CVSS
—
EPSS
11%
Percentile
96.0
In the wild
Unconfirmed
What it is

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.11330 · 96.0th percentile
Weakness
CWE-287 · Improper Authentication
Published
2021-01-27T00:00Z
EPSS history
Timeline
  • 27 JAN 00:00Z
    ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind
    cvelistv5