CVE-2015-6524
Improper Input Validation in Apache ActiveMQ
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.
Exploit likelihood
What each source reports
NVD Score used
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.
- Record
CVE-2015-6524- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-255
- Updated
- 2026-11-02
CVE List No score
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.
- Record
CVE-2015-6524- Updated
- 2026-11-02
EUVDEUVD-2022-1890 No score
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.
- Record
EUVD-2022-1890- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-23cr-5hr4-rgwv No score
Improper Input Validation in Apache ActiveMQ
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.
- Record
GHSA-23cr-5hr4-rgwv- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.
- Record
CVE-2015-6524- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-6524 No score
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.
- Record
DEBIAN-CVE-2015-6524- Updated
- 2026-11-02
OSVGHSA-23cr-5hr4-rgwv No score
Improper Input Validation in Apache ActiveMQ
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.
- Record
GHSA-23cr-5hr4-rgwv- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-6524 No score
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.
- Record
UBUNTU-CVE-2015-6524- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.activemq:activemq-brokerMaven |
5.0.0 to 5.10.1 | 5.10.2 |
org.apache.activemq:activemq-jaasMaven |
5.0.0 to 5.10.1 | 5.10.2 |
activemqDebian:12 |
before 5.6.0+dfsg1-4 | 5.6.0+dfsg1-4 |
activemqDebian:13 |
before 5.6.0+dfsg1-4 | 5.6.0+dfsg1-4 |
org.apache.activemq:activemq-brokerMaven |
5.0.0 up to 5.10.2, plus listed versions 5.10.05.10.15.8.05.9.05.9.1 |
5.10.2 |
org.apache.activemq:activemq-jaasMaven |
5.0.0 up to 5.10.2, plus listed versions 5.1.05.10.05.10.15.2.05.3.0 Show 13 moreShow less5.3.15.3.25.4.05.4.15.4.25.4.35.5.05.5.15.6.05.7.05.8.05.9.05.9.1 |
5.10.2 |
activemqUbuntu:14.04:LTS |
before 5.6.0+dfsg-1+deb7u1build0.14.04.1, plus listed versions 5.6.0+dfsg-1 |
5.6.0+dfsg-1+deb7u1build0.14.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-6524 is a medium vulnerability (CVSS 5.0) in Apache Activemq, published August 24, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.24%, the 94th percentile. Fixed in org.apache.activemq:activemq-broker 5.10.2.
References
lists.fedoraproject.org/pipermail/package-announce/2015-October/168651.html
activemq.apache.org/security-advisories.data/CVE-2014-3612-announcement.txt
nvd.nist.gov/vuln/detail/CVE-2015-6524
github.com/apache/activemq/commit/22f2f3dde757d31307da772d579815c1d169bc39