CVE-2012-5629

CWE-264CWE-20 — Improper Input ValidationCWE-3055 documents5 sources
Severity
7.5HIGH
EPSS
0.8%
top 26.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Redhat Jboss Enterprise Application PlatformRedhat Jboss Enterprise WEB Platform
Timeline
PublishedMar 12
Latest updateMay 17

Description

The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP) 5.2.0 allow remote attackers to bypass authentication via an empty password.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-m4f6-9xf8-2whr: The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4↗2022-05-17
▶
CVEList
CVE-2012-5629: The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4↗2013-03-12
▶

📋Vendor Advisories

1
Red Hat
JBoss: allows empty password to authenticate against LDAP↗2013-02-04
▶

💬Community

1
Bugzilla
CVE-2012-5629 JBoss: allows empty password to authenticate against LDAP↗2012-12-10
▶
CVE-2012-5629 (HIGH CVSS 7.5) | The default configuration of the (1 | cvebase.io