CVE-2012-5629 Auth bypass in n/a

High 7.5 Published 12 Mar 2013 Updated 6 Aug 2024

Remote attackers can bypass authentication in JBoss EAP by using an empty password due to insecure default configuration.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2012-5629?

CVE-2012-5629 is a high-severity authentication bypass vulnerability in Redhat Jboss Enterprise Application Platform, published on 12 Mar 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP) 5.2.0 allow remote attackers to bypass authentication via an empty password.

Weakness: CWE-264

Which versions are affected by CVE-2012-5629?

It affects 2 products.

Linux distribution packages (13)

`jbossas` Red Hat:jboss_enterprise_application_platform:4.3.0::el4	All versions	`0:4.3.0-12.GA_CP10_patch_01.1.ep1.el4`
`jbossas-client` Red Hat:jboss_enterprise_application_platform:4.3.0::el4	All versions	`0:4.3.0-12.GA_CP10_patch_01.1.ep1.el4`
`jbossas` Red Hat:jboss_enterprise_application_platform:4.3.0::el5	All versions	`0:4.3.0-12.GA_CP10_patch_01.1.ep1.el5`
`jbossas-client` Red Hat:jboss_enterprise_application_platform:4.3.0::el5	All versions	`0:4.3.0-12.GA_CP10_patch_01.1.ep1.el5`
`jbosssx2` Red Hat:jboss_enterprise_application_platform:5::el4	All versions	`0:2.0.5-9.SP3_1_patch_01.ep5.el4`
`jbosssx2` Red Hat:jboss_enterprise_application_platform:5::el5	All versions	`0:2.0.5-9.SP3_1_patch_01.ep5.el5`
`jbosssx2` Red Hat:jboss_enterprise_application_platform:5::el6	All versions	`0:2.0.5-9.1.SP3_1_patch_01.ep5.el6`
`jboss-as-domain-management` Red Hat:jboss_enterprise_application_platform:6::el5	All versions	`0:7.1.3-5.Final_redhat_5.ep6.el5`
`picketbox` Red Hat:jboss_enterprise_application_platform:6::el5	All versions	`0:4.0.14-3.Final_redhat_3.ep6.el5`
`jboss-as-domain-management` Red Hat:jboss_enterprise_application_platform:6::el6	All versions	`0:7.1.3-5.Final_redhat_5.ep6.el6`
`picketbox` Red Hat:jboss_enterprise_application_platform:6::el6	All versions	`0:4.0.14-3.Final_redhat_3.ep6.el6`
`jbosssx2` Red Hat:jboss_enterprise_web_platform:5::el5	All versions	`0:2.0.5-9.SP3_1_patch_01.ep5.el5`
`jbosssx2` Red Hat:jboss_enterprise_web_platform:5::el6	All versions	`0:2.0.5-9.1.SP3_1_patch_01.ep5.el6`

Products include Redhat Jboss Enterprise Application Platform, Redhat Jboss Enterprise Web Platform.

How do I fix CVE-2012-5629?

Apply the vendor's patch.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2012-5629 being exploited?

There is no known exploitation of CVE-2012-5629 in the wild and no public exploit code.

All Redhat Jboss Enterprise Application Platform vulnerabilities

Sources

Also known as GHSA-m4f6-9xf8-2whr, RHSA-2013:0229, RHSA-2013:0230, RHSA-2013:0231, RHSA-2013:0249.