BIT-activemq-2021-26117

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/activemq/BIT-activemq-2021-26117.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-activemq-2021-26117

Aliases

Published

2024-03-06T10:50:53.474Z

Modified

2024-03-06T11:25:28.861Z

Summary

[none]

Details

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.

Database specific

{
    "cpes": [
        "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
}

References

Affected packages

Bitnami / activemq

Package

Name: activemq
Purl: pkg:bitnami/activemq

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

5.15.0

Fixed

5.15.14

Introduced

5.16.0

Fixed

5.16.1