Description

The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP) 5.2.0 allow remote attackers to bypass authentication via an empty password.

Remediation

References

CVE-2012-5629

Related Vulnerabilities

WordPress Plugin Appointment Calendar Multiple Cross-Site Scripting Vulnerabilities (2.7.4)

WordPress 5.0.x Multiple Vulnerabilities (5.0 - 5.0.19)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-23172)

MySQL Other Vulnerability (CVE-2003-0073)

Plone CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-5502)

Severity

High

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2012-5629