Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5
CVSSv2

CVE-2015-6524

Published: 24/08/2015 Updated: 09/12/2016
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Subscribe to Fedoraproject

Vulnerability Summary

The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x prior to 5.10.1 allows wildcard operators in usernames, which allows remote malicious users to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

fedoraproject fedora 22

fedoraproject fedora 23

apache activemq 5.0.0

apache activemq 5.4.0

apache activemq 5.4.2

apache activemq 5.7.0

apache activemq 5.9.0

apache activemq 5.4.3

apache activemq 5.5.0

apache activemq 5.5.1

apache activemq 5.6.0

apache activemq 5.10.0

apache activemq 5.2.0

apache activemq 5.3.0

apache activemq 5.3.1

apache activemq 5.1.0

apache activemq 5.3.2

apache activemq 5.4.1

apache activemq 5.8.0

apache activemq 5.9.1

Vendor Advisories

Red Hat: CVE-2015-6524
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5x before 5101 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types ...

References

CWE-255http://activemq.apache.org/security-advisories.data/CVE-2014-3612-announcement.txthttp://lists.fedoraproject.org/pipermail/package-announce/2015-October/168651.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-October/168094.htmlhttps://nvd.nist.govhttps://access.redhat.com/security/cve/cve-2015-6524
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-21991CVE-2024-32674path traversalCVE-2023-21987denial of servicedosCVE-2024-4647CVE-2024-25519CVE-2024-33612
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook