Improper Authentication in ActiveMQ - CVE-2014-3612

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU40673

Improper Authentication in ActiveMQ - CVE-2014-3612

Published: August 24, 2015 / Updated: August 9, 2020


Vulnerability identifier: #VU40673
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2014-3612
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: Apache Foundation
Affected software:
ActiveMQ

Detailed vulnerability description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.


How to mitigate CVE-2014-3612

Install update from vendor's website.

Sources