Auth bypass in Apache Activemq
CVE-2014-3612
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, w…
Vulnerability class: Broken Authentication
EPSS: 0.007 (72.5th percentile) — read the EPSS interpretation.
Affected products
- Apache Activemq — versions 5.0.0, 5.1.0, 5.2.0
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- 72513 (vdb-entry, x_refsource_BID)
- [oss-security] 20150205 [ANNOUNCE] CVE-2014-3600, CVE-2014-3612 and CVE-2014-8110 - Apache ActiveMQ vulnerabilities (mailing-list, x_refsource_MLIST)
- secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
- RHSA-2015:0137 (x_refsource_REDHAT, vendor-advisory)
- RHSA-2015:0138 (x_refsource_REDHAT, vendor-advisory)
- [activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/ (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2014-3612?
- CVE-2014-3612 is a vulnerability in Apache Activemq, classified under Improper Authentication. Published 2015-08-24.
- Is CVE-2014-3612 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.