CVE-2012-5629

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2012-5629
The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP) 5.2.0 allow remote attackers to bypass authentication via an empty password.

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=885569
http://rhn.redhat.com/errata/RHSA-2013-0229.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0230.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0231.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0232.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0233.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0234.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0248.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0533.html
http://rhn.redhat.com/errata/RHSA-2013-0586.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.2.0:*:*:*:*:*:*:*
History

13 Feb 2023, 00:26

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2013:0533', 'name': 'https://access.redhat.com/errata/RHSA-2013:0533', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=885569', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=885569', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2013:0586', 'name': 'https://access.redhat.com/errata/RHSA-2013:0586', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2013:0248', 'name': 'https://access.redhat.com/errata/RHSA-2013:0248', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2013:0230', 'name': 'https://access.redhat.com/errata/RHSA-2013:0230', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2013:0665', 'name': 'https://access.redhat.com/errata/RHSA-2013:0665', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2013:0234', 'name': 'https://access.redhat.com/errata/RHSA-2013:0234', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2013:0232', 'name': 'https://access.redhat.com/errata/RHSA-2013:0232', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2013:0231', 'name': 'https://access.redhat.com/errata/RHSA-2013:0231', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2013:0229', 'name': 'https://access.redhat.com/errata/RHSA-2013:0229', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2012-5629', 'name': 'https://access.redhat.com/security/cve/CVE-2012-5629', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2013:0249', 'name': 'https://access.redhat.com/errata/RHSA-2013:0249', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2013:0233', 'name': 'https://access.redhat.com/errata/RHSA-2013:0233', 'tags': [], 'refsource': 'MISC'}
Summary CVE-2012-5629 JBoss: allows empty password to authenticate against LDAP The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP) 5.2.0 allow remote attackers to bypass authentication via an empty password.

02 Feb 2023, 18:16

Type Values Removed Values Added
Summary The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP) 5.2.0 allow remote attackers to bypass authentication via an empty password. CVE-2012-5629 JBoss: allows empty password to authenticate against LDAP
References
  • (MISC) https://access.redhat.com/errata/RHSA-2013:0533 -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=885569 -
  • (MISC) https://access.redhat.com/errata/RHSA-2013:0586 -
  • (MISC) https://access.redhat.com/errata/RHSA-2013:0248 -
  • (MISC) https://access.redhat.com/errata/RHSA-2013:0230 -
  • (MISC) https://access.redhat.com/errata/RHSA-2013:0665 -
  • (MISC) https://access.redhat.com/errata/RHSA-2013:0234 -
  • (MISC) https://access.redhat.com/errata/RHSA-2013:0232 -
  • (MISC) https://access.redhat.com/errata/RHSA-2013:0231 -
  • (MISC) https://access.redhat.com/errata/RHSA-2013:0229 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2012-5629 -
  • (MISC) https://access.redhat.com/errata/RHSA-2013:0249 -
  • (MISC) https://access.redhat.com/errata/RHSA-2013:0233 -
Information

Published : 2013-03-12 23:55

Updated : 2023-12-10 11:16

NVD link : CVE-2012-5629

Mitre link : CVE-2012-5629

CVE.ORG link : CVE-2012-5629

JSON object : View

Products Affected

redhat

  • jboss_enterprise_application_platform
  • jboss_enterprise_web_platform
CWE
CWE-264

Permissions, Privileges, and Access Controls