NVD

Id
31777  
Name
CVE-2014-3612  
Description
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-08-24  
Modified Date
2016-05-19  
Seq
2014-3612  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
167452 31777 CVE-2014-3612 http://activemq.apache.org/security-advisories.data/CVE-2014-3612-announcement.txt  View
167453 31777 CVE-2014-3612 RHSA-2015:0137  View
167454 31777 CVE-2014-3612 RHSA-2015:0138  View
167455 31777 CVE-2014-3612 [oss-security] 20150205 [ANNOUNCE] CVE-2014-3600, CVE-2014-3612 and CVE-2014-8110 - Apache ActiveMQ vulnerabilities  View
167456 31777 CVE-2014-3612 72513  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
19230 JVNDB-2014-008107 Apache ActiveMQ の Java Authentication and Authorization Service の LDAPLoginModule の実装における認証を回避される脆弱性 Apache ActiveMQ の Java Authentication and Authorization Service (JAAS) の LDAPLoginModule の実装には、認証を回避される脆弱性が存在します。 CVE-2014-3612 70900 CVE-2014-3612 31777 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-008107.html 2014-05-14 2015-08-27 View