CVE-2015-6524

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-255

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://activemq.apache.org/security-advisories.data/CVE-2014-3612-announcement.txtVendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168094.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168651.htmlThird Party Advisory
http://activemq.apache.org/security-advisories.data/CVE-2014-3612-announcement.txtVendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168094.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168651.htmlThird Party Advisory

Timeline

Published: Aug 24, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-65257.5Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta allow context-dependent attackers CVE-2015-65264.9The perf_callchain_user_64 function in arch/powerpc/perf/callchain.c in the Linux kernel before 4.0.2 on ppc64 platforms allows local users CVE-2015-65277.3The php_str_replace_in_subject function in ext/standard/string.c in PHP 7.x before 7.0.0 allows remote attackers to execute arbitrary code v CVE-2015-65284.3Multiple cross-site scripting (XSS) vulnerabilities in install_classic.php in Coppermine Photo Gallery (CPG) 1.5.36 allow remote attackers t CVE-2015-65294.3Multiple cross-site scripting (XSS) vulnerabilities in phpipam 1.1.010 allow remote attackers to inject arbitrary web script or HTML via the CVE-2015-65304.3Cross-site scripting (XSS) vulnerability in OpenText Secure MFT 2013 before 2013 R3 P6 and 2014 before 2014 R2 P2 allows remote attackers to CVE-2015-65317.8Palo Alto Networks Panorama VM Appliance with PAN-OS before 6.0.1 might allow remote attackers to execute arbitrary Python code via a crafte CVE-2015-65353.5Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remo CVE-2015-65379.8SQL injection vulnerability in the login page in Epiphany Cardio Server 3.3 allows remote attackers to execute arbitrary SQL commands via a CVE-2015-65389.8The login page in Epiphany Cardio Server 3.3, 4.0, and 4.1 mishandles authentication requests, which allows remote attackers to conduct LDAP CVE-2015-65406.1Cross-site scripting (XSS) vulnerability in Intellect Design Arena Intellect Core banking software.CVE-2015-65418.8Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) before 8.5 allow remot