#VU40673 Improper Authentication in ActiveMQ - CVE-2014-3612 

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU40673

#VU40673 Improper Authentication in ActiveMQ - CVE-2014-3612

Published: August 24, 2015 / Updated: August 9, 2020


Vulnerability identifier: #VU40673
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2014-3612
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
ActiveMQ
Software vendor:
Apache Foundation

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.


Remediation

Install update from vendor's website.

External links