CVE-2012-5629

2013-03-1223:55:01

CWE-264

[email protected]

web.nvd.nist.gov

jboss

eap

ewp

ldaploginmodule

ldapextloginmodule

authentication bypass

empty password

cve-2012-5629

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

5.7 Medium

AI Score

Confidence

High

0.014 Low

EPSS

Percentile

86.2%

JSON

The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP) 5.2.0 allow remote attackers to bypass authentication via an empty password.

Affected configurations

NVD

Node

redhatjboss_enterprise_application_platformMatch4.3.0

redhatjboss_enterprise_application_platformMatch5.2.0

redhatjboss_enterprise_application_platformMatch6.0.1

redhatjboss_enterprise_web_platformMatch5.2.0

CPENameOperatorVersion
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq4.3.0
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq5.2.0
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq6.0.1
redhat:jboss_enterprise_web_platformredhat jboss enterprise web platformeq5.2.0

CPE	Name	Operator	Version
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	4.3.0
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	5.2.0
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	6.0.1
redhat:jboss_enterprise_web_platform	redhat jboss enterprise web platform	eq	5.2.0