{"id":"CVE-2012-5629","aliases":["EUVD-2012-5514","GHSA-m4f6-9xf8-2whr","RHSA-2013:0229","RHSA-2013:0230","RHSA-2013:0231","RHSA-2013:0249"],"status":"published","title":"The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss...","description":"The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP) 5.2.0 allow remote attackers to bypass authentication via an empty password.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02344,"percentile":0.83764,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2013-03-12T22:00:00Z","modified":"2026-08-05T10:02:00Z","fixes":[{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"jbosssx2","fixed_in":["0:2.0.5-9.SP3_1_patch_01.ep5.el4"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"jbosssx2","fixed_in":["0:2.0.5-9.SP3_1_patch_01.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jbosssx2","fixed_in":["0:2.0.5-9.1.SP3_1_patch_01.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"jbosssx2","fixed_in":["0:2.0.5-9.SP3_1_patch_01.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"jbosssx2","fixed_in":["0:2.0.5-9.1.SP3_1_patch_01.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-domain-management","fixed_in":["0:7.1.3-5.Final_redhat_5.ep6.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"picketbox","fixed_in":["0:4.0.14-3.Final_redhat_3.ep6.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-domain-management","fixed_in":["0:7.1.3-5.Final_redhat_5.ep6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"picketbox","fixed_in":["0:4.0.14-3.Final_redhat_3.ep6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jbossas","fixed_in":["0:4.3.0-12.GA_CP10_patch_01.1.ep1.el4"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jbossas-client","fixed_in":["0:4.3.0-12.GA_CP10_patch_01.1.ep1.el4"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jbossas","fixed_in":["0:4.3.0-12.GA_CP10_patch_01.1.ep1.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jbossas-client","fixed_in":["0:4.3.0-12.GA_CP10_patch_01.1.ep1.el5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"jbosssx2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.5-9.SP3_1_patch_01.ep5.el4"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"jbosssx2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.5-9.SP3_1_patch_01.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jbosssx2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.5-9.1.SP3_1_patch_01.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"jbosssx2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.5-9.SP3_1_patch_01.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"jbosssx2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.5-9.1.SP3_1_patch_01.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jboss-as-domain-management","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.1.3-5.Final_redhat_5.ep6.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"picketbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.14-3.Final_redhat_3.ep6.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jboss-as-domain-management","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.1.3-5.Final_redhat_5.ep6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"picketbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.14-3.Final_redhat_3.ep6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jbossas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-12.GA_CP10_patch_01.1.ep1.el4"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jbossas-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-12.GA_CP10_patch_01.1.ep1.el4"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jbossas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-12.GA_CP10_patch_01.1.ep1.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jbossas-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-12.GA_CP10_patch_01.1.ep1.el5"}]}]}],"products":[{"vendor":"redhat","product":"jboss_enterprise_application_platform"},{"vendor":"redhat","product":"jboss_enterprise_web_platform"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2013-0234.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0586.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0248.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=885569","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0229.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0230.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0232.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0533.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0231.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0233.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5629","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0229","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0230","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0231","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0232"},{"url":"https://access.redhat.com/errata/RHSA-2013:0233"},{"url":"https://access.redhat.com/errata/RHSA-2013:0234"},{"url":"https://access.redhat.com/errata/RHSA-2013:0248"},{"url":"https://access.redhat.com/errata/RHSA-2013:0249","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0533"},{"url":"https://access.redhat.com/errata/RHSA-2013:0586"},{"url":"https://access.redhat.com/errata/RHSA-2013:0665"},{"url":"https://access.redhat.com/security/cve/CVE-2012-5629","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=885569","tags":["report"]},{"url":"https://github.com/advisories/GHSA-m4f6-9xf8-2whr"},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"http://tools.ietf.org/html/rfc4513","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0229.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-5629","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0230.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0231.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0249.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2012-5629","description":"The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP) 5.2.0 allow remote attackers to bypass authentication via an empty password.","status":"published","published":"2013-03-12T22:00:00Z","modified":"2024-08-06T21:14:15.932Z","updated_at":"2026-11-02T14:34:49.600255Z"}],"euvd":[{"id":"EUVD-2012-5514","description":"The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP) 5.2.0 allow remote attackers to bypass authentication via an empty password.","status":"published","published":"2013-03-12T22:00:00Z","modified":"2024-08-06T21:14:15Z","updated_at":"2026-11-03T01:56:04.46975Z"}],"ghsa":[{"id":"GHSA-m4f6-9xf8-2whr","title":"The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss...","description":"The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP) 5.2.0 allow remote attackers to bypass authentication via an empty password.","status":"published","published":"2022-05-17T04:17:07Z","modified":"2023-02-10T05:06:56Z","updated_at":"2026-11-02T14:54:03.327923Z"}],"nvd":[{"id":"CVE-2012-5629","description":"The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP) 5.2.0 allow remote attackers to bypass authentication via an empty password.","status":"published","published":"2013-03-12T23:55:01.38Z","modified":"2026-06-16T23:47:07.203Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:17.375282Z"}],"osv":[{"id":"RHSA-2013:0229","title":"Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 security update","status":"published","published":"2024-09-15T20:31:16Z","modified":"2026-08-05T10:01:59Z","updated_at":"2026-11-02T15:53:01.495018Z"},{"id":"RHSA-2013:0230","title":"Red Hat Security Advisory: JBoss Enterprise Web Platform 5.2.0 security update","status":"published","published":"2024-09-15T20:31:20Z","modified":"2026-08-05T10:01:59Z","updated_at":"2026-11-02T15:53:01.495018Z"},{"id":"RHSA-2013:0231","title":"Red Hat Security Advisory: JBoss Enterprise Application Platform 6.0.1 security update","status":"published","published":"2024-09-15T20:31:24Z","modified":"2026-08-05T10:01:59Z","updated_at":"2026-11-02T15:53:01.495018Z"},{"id":"RHSA-2013:0249","title":"Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0 CP10 security update","status":"published","published":"2024-09-15T20:31:46Z","modified":"2026-08-05T10:02:00Z","updated_at":"2026-11-02T15:53:01.495018Z"}]}}