CVE-2012-5629

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP) 5.2.0 allow remote attackers to bypass authentication via an empty password.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=885569
http://rhn.redhat.com/errata/RHSA-2013-0229.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0230.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0231.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0232.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0233.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0234.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0248.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0533.html
http://rhn.redhat.com/errata/RHSA-2013-0586.html
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=885569
http://rhn.redhat.com/errata/RHSA-2013-0229.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0230.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0231.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0232.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0233.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0234.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0248.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0533.html
http://rhn.redhat.com/errata/RHSA-2013-0586.html

Timeline

Published: Mar 12, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-56306.3libuser 0.56 and 0.57 has a TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees.CVE-2012-56318.8ipa 3.0 does not properly check server identity before sending credential containing cookies CVE-2012-56335.8The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasse CVE-2012-56346.1Xen 4.2.x, 4.1.x, and 4.0, when using Intel VT-d for PCI passthrough, does not properly configure VT-d when supporting a device that is behi CVE-2012-56352.1The GlusterFS functionality in Red Hat Storage Management Console 2.0, Native Client, and Server 2.0 allows local users to overwrite arbitra CVE-2012-56366.1Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote CVE-2012-56383.6The setup_logging function in log.h in SANLock uses world-writable permissions for /var/log/sanlock.log, which allows local users to overwri CVE-2012-56396.5LibreOffice and OpenOffice automatically open embedded content CVE-2012-56405.5thttpd has a local DoS vulnerability via specially-crafted .htpasswd files CVE-2012-56415.0Directory traversal vulnerability in the partition2 function in mochiweb_util.erl in MochiWeb before 2.4.0, as used in Apache CouchDB before CVE-2012-56427.5server/action.py in Fail2ban before 0.8.8 does not properly handle the content of the matches tag, which might allow remote attackers to tri CVE-2012-56435.0Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2