CVE-2015-6524

The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.

• CWE-255

• http://activemq.apache.org/security-advisories.data/CVE-2014-3612-announcement.txtVendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168094.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168651.htmlThird Party Advisory
• http://activemq.apache.org/security-advisories.data/CVE-2014-3612-announcement.txtVendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168094.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168651.htmlThird Party Advisory

Published

Aug 24, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-6518Multiple cross-site scripting (XSS) vulnerabilities in phpLi…
• CVE-2015-6519SQL injection vulnerability in Arab Portal 3 allows remote a…
• CVE-2015-6520IPPUSBXD before 1.22 listens on all interfaces, which allows…
• CVE-2015-6521Multiple cross-site scripting (XSS) vulnerabilities in ATuto…
• CVE-2015-6522SQL injection vulnerability in the WP Symposium plugin befor…
• CVE-2015-6523Cross-site request forgery (CSRF) vulnerability in the Portf…
• CVE-2015-6525Multiple integer overflows in the evbuffer API in Libevent 2…
• CVE-2015-6526The perf_callchain_user_64 function in arch/powerpc/perf/cal…
• CVE-2015-6527The php_str_replace_in_subject function in ext/standard/stri…7.3
• CVE-2015-6528Multiple cross-site scripting (XSS) vulnerabilities in insta…
• CVE-2015-6529Multiple cross-site scripting (XSS) vulnerabilities in phpip…
• CVE-2015-6530Cross-site scripting (XSS) vulnerability in OpenText Secure …