Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-72m6-23ff-7q26
Advisory ID github_osv/GHSA-72m6-23ff-7q26
Aliases CVE-2014-3612
Summary Improper Authentication in Apache WSS4J The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-287 Improper Authentication
System Score Found at
generic_textual HIGH
Reference id Reference type URL
http://seclists.org/oss-sec/2015/q1/427
https://github.com/apache/activemq
https://github.com/apache/activemq/commit/22f2f3dde757d31307da772d579815c1d169bc39
https://issues.apache.org/jira/browse/AMQ-5345
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E
http://www.securityfocus.com/bid/72513
CVE-2014-3612 https://nvd.nist.gov/vuln/detail/CVE-2014-3612
CVE-2014-3612-ANNOUNCEMENT.TXT http://activemq.apache.org/security-advisories.data/CVE-2014-3612-announcement.txt
RHSA-2015-0137.html http://rhn.redhat.com/errata/RHSA-2015-0137.html
RHSA-2015-0138.html http://rhn.redhat.com/errata/RHSA-2015-0138.html
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.