Description

The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP) 5.2.0 allow remote attackers to bypass authentication via an empty password.

Remediation

References

CVE-2012-5629

Related Vulnerabilities

MySQL CVE-2021-2144 Vulnerability (CVE-2021-2144)

Drupal Core 8.9.x Cross-Site Scripting (8.9.0 - 8.9.13)

Drupal Core 8.x.x Cross-Site Scripting (8.0.0 - 8.4.6)

WordPress Plugin Testimonials Widget Cross-Site Scripting (3.5.1)

phpList Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-15073)

Severity

High

Classification

CVE-2012-5629 CWE-264

Tags

Missing Update Known Vulnerabilities