{"id":"CVE-2015-6524","published":"2015-08-24T14:00:00Z","modified":"2024-08-06T07:22:22Z","title":"The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x…","vendor":null,"product":null,"tier":"tail","description":{"text":"The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.08243,"percentile":0.94877,"provenance":"source"},"cwes":[],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168651.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://activemq.apache.org/security-advisories.data/CVE-2014-3612-announcement.txt","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168094.html","tags":["vendor-advisory","x_refsource_FEDORA"]}],"priority":{"score":19.0,"factors":[{"name":"EPSS percentile","points":18.98}]},"affected":[{"ecosystem":"Maven","package":"org.apache.activemq:activemq-broker","vulnerableRanges":[">=5.0.0, <5.10.2"],"patched":["5.10.2"],"from":["GHSA-23cr-5hr4-rgwv"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.activemq:activemq-jaas","vulnerableRanges":[">=5.0.0, <5.10.2"],"patched":["5.10.2"],"from":["GHSA-23cr-5hr4-rgwv"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-1890","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2014-3600","published":"2017-10-27","fixed":"5.10.1","kev":false},{"cve":"CVE-2014-3612","published":"2015-08-24","fixed":"5.10.1","kev":false,"link":{"from":"CVE-2014-3612","to":"CVE-2015-6524","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.activemq:activemq-broker","fromFixed":"5.10.1","toFixed":"5.10.2","daysApart":0},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.activemq:activemq-jaas","fromFixed":"5.10.1","toFixed":"5.10.2","daysApart":0},{"kind":"similar","provenance":"machine","score":0.81,"basis":"same package + description similarity"}]}},{"cve":"CVE-2015-6524","published":"2015-08-24","fixed":"5.10.2","kev":false},{"cve":"CVE-2026-33227","published":"2026-04-07","fixed":"6.2.2","kev":false},{"cve":"CVE-2026-34197","published":"2026-04-07","fixed":"6.2.3","kev":true},{"cve":"CVE-2026-39304","published":"2026-04-10","fixed":"6.2.4","kev":false}],"package":"Maven:org.apache.activemq:activemq-broker"}}