Description
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.
Remediation
References
http://rhn.redhat.com/errata/RHSA-2015-0137.html
http://rhn.redhat.com/errata/RHSA-2015-0138.html
http://activemq.apache.org/security-advisories.data/CVE-2014-3612-announcement.txt
http://seclists.org/oss-sec/2015/q1/427
http://www.securityfocus.com/bid/72513
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E
Related Vulnerabilities
CVE-2016-6651 Vulnerability in maven package org.cloudfoundry.identity:cloudfoundry-identity-common
CVE-2019-16563 Vulnerability in maven package tech.andrey.jenkins:mission-control-view
CVE-2016-2171 Vulnerability in maven package org.apache.portals.jetspeed-2:jetspeed-security
CVE-2007-0185 Vulnerability in maven package dwr:dwr
CVE-2021-42550 Vulnerability in maven package ch.qos.logback:logback-core