CVE-2014-3612

The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.

• CWE-287

• http://activemq.apache.org/security-advisories.data/CVE-2014-3612-announcement.txtVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0137.html
• http://rhn.redhat.com/errata/RHSA-2015-0138.html
• http://seclists.org/oss-sec/2015/q1/427
• http://www.securityfocus.com/bid/72513
• https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E
• http://activemq.apache.org/security-advisories.data/CVE-2014-3612-announcement.txtVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0137.html
• http://rhn.redhat.com/errata/RHSA-2015-0138.html
• http://seclists.org/oss-sec/2015/q1/427
• http://www.securityfocus.com/bid/72513
• https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E

Published

Aug 24, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3606Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2014-3607DefaultHostnameVerifier in Ldaptive (formerly vt-ldap) does …
• CVE-2014-3608The VMWare driver in OpenStack Compute (Nova) before 2014.1.…
• CVE-2014-3609HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before …
• CVE-2014-3610The WRMSR processing functionality in the KVM subsystem in t…5.5
• CVE-2014-3611Race condition in the __kvm_migrate_pit_timer function in ar…4.7
• CVE-2014-3613cURL and libcurl before 7.38.0 does not properly handle IP a…
• CVE-2014-3614Unspecified vulnerability in PowerDNS Recursor (aka pdns_rec…
• CVE-2014-3615The VGA emulator in QEMU allows local guest users to read ho…
• CVE-2014-3616nginx 0.5.6 through 1.7.4, when using the same shared ssl_se…
• CVE-2014-3617The forum_print_latest_discussions function in mod/forum/lib…
• CVE-2014-3618Heap-based buffer overflow in formisc.c in formail in procma…