CVE-2015-6524: apache activemq Credentials Management Errors
Vulnerability summary
CVE-2015-6524 is a medium (CVSS 5.0) Credentials Management Errors vulnerability in apache activemq. EPSS estimates a 8.57% chance of exploitation in the next 30 days, higher than 95% of scored vulnerabilities.
Timeline
- 24-08-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
8.57%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
0.00 pp
From 8.57% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Org.apache.activemq2 products
- activemq-broker≥ 5.0.0, < 5.10.2
- activemq-jaas≥ 5.0.0, < 5.10.2
Apache1 product
- activemqEOL5.0.0 | 5.1.0 | 5.2.0 | 5.3.0 | 5.3.1 | 5.3.2 | 5.4.0 | 5.4.1 | 5.4.2 | 5.4.3 | 5.5.0 | 5.5.1 | 5.6.0 | 5.7.0 | 5.8.0 | 5.9.0 | 5.9.1 | 5.10.0
Debian1 product
- activemq< 5.6.0+dfsg1-4
Fedoraproject1 product
- fedoraEOL22 | 23
Ubuntu1 product
- activemq< 5.6.0+dfsg-1+deb7u1build0.14.04.1
5 vendors · 6 products
References
9 links- lists.fedoraproject.org/pipermail/package-announce/2015-October/168651.htmlVendor AdvisoryX Refsource FEDORAThird Party AdvisoryWEB
- activemq.apache.org/security-advisories.data/CVE-2014-3612-announcement.txtX Refsource CONFIRMVendor AdvisoryREPORTWEB
- lists.fedoraproject.org/pipermail/package-announce/2015-October/168094.htmlVendor AdvisoryX Refsource FEDORAThird Party AdvisoryWEB
