CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2014-3612

The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.007

EPSS Ranking 70.6%

CVSS Severity

CVSS v2 Score 7.5

References

Products affected by CVE-2014-3612

Apache » Activemq » Version: 5.0.0

cpe:2.3:a:apache:activemq:5.0.0
Apache » Activemq » Version: 5.1.0

cpe:2.3:a:apache:activemq:5.1.0
Apache » Activemq » Version: 5.10.0

cpe:2.3:a:apache:activemq:5.10.0
Apache » Activemq » Version: 5.2.0

cpe:2.3:a:apache:activemq:5.2.0
Apache » Activemq » Version: 5.3.0

cpe:2.3:a:apache:activemq:5.3.0
Apache » Activemq » Version: 5.3.1

cpe:2.3:a:apache:activemq:5.3.1
Apache » Activemq » Version: 5.3.2

cpe:2.3:a:apache:activemq:5.3.2
Apache » Activemq » Version: 5.4.0

cpe:2.3:a:apache:activemq:5.4.0
Apache » Activemq » Version: 5.4.1

cpe:2.3:a:apache:activemq:5.4.1
Apache » Activemq » Version: 5.4.2

cpe:2.3:a:apache:activemq:5.4.2
Apache » Activemq » Version: 5.4.3

cpe:2.3:a:apache:activemq:5.4.3
Apache » Activemq » Version: 5.5.0

cpe:2.3:a:apache:activemq:5.5.0
Apache » Activemq » Version: 5.5.1

cpe:2.3:a:apache:activemq:5.5.1
Apache » Activemq » Version: 5.6.0

cpe:2.3:a:apache:activemq:5.6.0
Apache » Activemq » Version: 5.7.0

cpe:2.3:a:apache:activemq:5.7.0
Apache » Activemq » Version: 5.8.0

cpe:2.3:a:apache:activemq:5.8.0
Apache » Activemq » Version: 5.9.0

cpe:2.3:a:apache:activemq:5.9.0
Apache » Activemq » Version: 5.9.1

cpe:2.3:a:apache:activemq:5.9.1

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2014-3612

Products

Pricing

Contact Us