Description

The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP) 5.2.0 allow remote attackers to bypass authentication via an empty password.

Remediation

References

CVE-2012-5629

Related Vulnerabilities

WordPress Plugin W4 Post List Multiple Vulnerabilities (2.4.5)

osTicket Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-1176)

Rukovoditel Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-43165)

Joomla! Core 1.6.x Security Bypass (1.6.0 - 1.6.6)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-19910)

Severity

High

Classification

CVE-2012-5629 CWE-264

Tags

Missing Update Known Vulnerabilities