CVE-2014-3612
Improper Authentication in Apache WSS4J
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.
Exploit likelihood
What each source reports
NVD Score used
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.
- Record
CVE-2014-3612- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.
- Record
CVE-2014-3612- Updated
- 2026-11-02
EUVDEUVD-2022-2892 No score
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.
- Record
EUVD-2022-2892- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-72m6-23ff-7q26 No score
Improper Authentication in Apache WSS4J
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.
- Record
GHSA-72m6-23ff-7q26- Weakness
- CWE-287
- Updated
- 2026-11-02
OSV No score
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.
- Record
CVE-2014-3612- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-3612 No score
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.
- Record
DEBIAN-CVE-2014-3612- Updated
- 2026-11-02
OSVGHSA-72m6-23ff-7q26 No score
Improper Authentication in Apache WSS4J
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.
- Record
GHSA-72m6-23ff-7q26- Weakness
- CWE-287
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-3612 No score
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.
- Record
UBUNTU-CVE-2014-3612- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.activemq:activemq-brokerMaven |
5.0.0 up to 5.10.1 | 5.10.1 |
org.apache.activemq:activemq-jaasMaven |
5.0.0 up to 5.10.1 | 5.10.1 |
activemqDebian:12 |
before 5.6.0+dfsg1-4 | 5.6.0+dfsg1-4 |
activemqDebian:13 |
before 5.6.0+dfsg1-4 | 5.6.0+dfsg1-4 |
org.apache.activemq:activemq-brokerMaven |
5.0.0 up to 5.10.1, plus listed versions 5.10.05.8.05.9.05.9.1 |
5.10.1 |
org.apache.activemq:activemq-jaasMaven |
5.0.0 up to 5.10.1, plus listed versions 5.1.05.10.05.2.05.3.05.3.1 Show 12 moreShow less5.3.25.4.05.4.15.4.25.4.35.5.05.5.15.6.05.7.05.8.05.9.05.9.1 |
5.10.1 |
activemqUbuntu:14.04:LTS |
before 5.6.0+dfsg-1+deb7u1build0.14.04.1, plus listed versions 5.6.0+dfsg-1 |
5.6.0+dfsg-1+deb7u1build0.14.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3612 is a high vulnerability (CVSS 7.5) in Apache Activemq, published August 24, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.90%, the 94th percentile. Fixed in org.apache.activemq:activemq-broker 5.10.1.
References
securityfocus.com/bid/72513
seclists.org/oss-sec/2015/q1/427
activemq.apache.org/security-advisories.data/CVE-2014-3612-announcement.txt
rhn.redhat.com/errata/RHSA-2015-0137.html
lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E
Show 9 moreShow less
nvd.nist.gov/vuln/detail/CVE-2014-3612
github.com/apache/activemq/commit/22f2f3dde757d31307da772d579815c1d169bc39
issues.apache.org/jira/browse/AMQ-5345
security-tracker.debian.org/tracker/CVE-2014-3612
ubuntu.com/security/CVE-2014-3612
cve.org/CVERecord?id=CVE-2014-3612