The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules…
Priority LOW 37CWE-264Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- Partial Red Hat: 22 fixed, 6 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-264.
Summary
The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP) 5.2.0 allow remote attackers to bypass authentication via an empty password.
Why it matters now
EPSS 0.02344 83rd percentileScored 2026-11-07
Fix Partial Red Hat: 11 advisoriesRed Hat: 22 fixed, 6 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:*:*:*:*:*:*:* | 4.3.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.0:*:*:*:*:*:*:* | 5.2.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.1:*:*:*:*:*:*:* | 6.0.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.2.0:*:*:*:*:*:*:* | 5.2.0 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2.0:*:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.1:*:*:*:*:*:*:* Versions 6.0.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.2.0:*:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·Red Hat
Remediation
Red Hat 11 advisories
- RHSA-2013:0665 Released 2013-03-20 · Red Hat rating ImportantJBoss Data Grid 6.1.0 update
- JBoss Data Grid 6.1
- RHSA-2013:0586 Released 2013-03-04 · Red Hat rating Importantjbosssx security update
- JBoss Enterprise BRMS Platform 5.3
- Red Hat JBoss Portal 4.3
- Red Hat JBoss Portal 5.2
- Red Hat JBoss SOA Platform 4.2
- Red Hat JBoss SOA Platform 4.3
- Red Hat JBoss SOA Platform 5.3
- RHSA-2013:0533 Released 2013-02-20 · Red Hat rating ImportantJBoss Enterprise SOA Platform 5.3.1 update
- Red Hat JBoss SOA Platform 5.3
Show 8 more Red Hat advisories
- RHSA-2013:0249 Released 2013-02-11 · Red Hat rating ImportantJBoss Enterprise Application Platform 4.3.0 CP10 security update
- Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS jbossas-4.3.0-12.GA_CP10_patch_01.1.ep1.el4, jbossas-client-4.3.0-12.GA_CP10_patch_01.1.ep1.el4
- Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES jbossas-4.3.0-12.GA_CP10_patch_01.1.ep1.el4, jbossas-client-4.3.0-12.GA_CP10_patch_01.1.ep1.el4
- Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server jbossas-4.3.0-12.GA_CP10_patch_01.1.ep1.el5, jbossas-client-4.3.0-12.GA_CP10_patch_01.1.ep1.el5
- RHSA-2013:0248 Released 2013-02-11 · Red Hat rating ImportantJBoss Enterprise Application Platform 4.3.0 CP10 security update
- Red Hat JBoss Enterprise Application Platform 4.3
- RHSA-2013:0234 Released 2013-02-04 · Red Hat rating ImportantJBoss Enterprise Application Platform 6.0.1 security update
- Red Hat JBoss Enterprise Application Platform 6.0
- RHSA-2013:0233 Released 2013-02-04 · Red Hat rating ImportantJBoss Enterprise Web Platform 5.2.0 security update
- Red Hat JBoss Web Platform 5.2
- RHSA-2013:0232 Released 2013-02-04 · Red Hat rating ImportantJBoss Enterprise Application Platform 5.2.0 security update
- Red Hat JBoss Enterprise Application Platform 5.2
- RHSA-2013:0231 Released 2013-02-04 · Red Hat rating ImportantJBoss Enterprise Application Platform 6.0.1 security update
- Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server jboss-as-domain-management-7.1.3-5.Final_redhat_5.ep6.el5, picketbox-4.0.14-3.Final_redhat_3.ep6.el5
- Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server jboss-as-domain-management-7.1.3-5.Final_redhat_5.ep6.el6, picketbox-4.0.14-3.Final_redhat_3.ep6.el6
- RHSA-2013:0230 Released 2013-02-04 · Red Hat rating ImportantJBoss Enterprise Web Platform 5.2.0 security update
- Red Hat JBoss Web Platform 5 for RHEL 5 Server jbosssx2-2.0.5-9.SP3_1_patch_01.ep5.el5
- Red Hat JBoss Web Platform 5 for RHEL 6 Server jbosssx2-2.0.5-9.1.SP3_1_patch_01.ep5.el6
- RHSA-2013:0229 Released 2013-02-04 · Red Hat rating ImportantJBoss Enterprise Application Platform 5.2.0 security update
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS jbosssx2-2.0.5-9.SP3_1_patch_01.ep5.el4
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES jbosssx2-2.0.5-9.SP3_1_patch_01.ep5.el4
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server jbosssx2-2.0.5-9.SP3_1_patch_01.ep5.el5
- Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server jbosssx2-2.0.5-9.1.SP3_1_patch_01.ep5.el6
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss BRMS 5 | Affected | No fix yet |
| Red Hat JBoss Data Grid 6 | Affected | No fix yet |
| Red Hat JBoss Portal 4 | Affected | No fix yet |
| Red Hat JBoss Portal 5 | Affected | No fix yet |
| Red Hat JBoss SOA Platform 4 | Affected | No fix yet |
| Red Hat JBoss SOA Platform 5 | Affected | No fix yet |
| JBoss Data Grid 6.1 | Fixed | RHSA-2013:0665 |
| JBoss Enterprise BRMS Platform 5.3 | Fixed | RHSA-2013:0586 |
| Red Hat JBoss Enterprise Application Platform 4.3 | Fixed | RHSA-2013:0248 |
| Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS | Fixed | RHSA-2013:0249 |
| Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES | Fixed | RHSA-2013:0249 |
| Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server | Fixed | RHSA-2013:0249 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS | Fixed | RHSA-2013:0229 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES | Fixed | RHSA-2013:0229 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server | Fixed | RHSA-2013:0229 |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server | Fixed | RHSA-2013:0229 |
| Red Hat JBoss Enterprise Application Platform 5.2 | Fixed | RHSA-2013:0232 |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server | Fixed | RHSA-2013:0231 |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server | Fixed | RHSA-2013:0231 |
| Red Hat JBoss Enterprise Application Platform 6.0 | Fixed | RHSA-2013:0234 |
| Red Hat JBoss Portal 4.3 | Fixed | RHSA-2013:0586 |
| Red Hat JBoss Portal 5.2 | Fixed | RHSA-2013:0586 |
| Red Hat JBoss SOA Platform 4.2 | Fixed | RHSA-2013:0586 |
| Red Hat JBoss SOA Platform 4.3 | Fixed | RHSA-2013:0586 |
| Red Hat JBoss SOA Platform 5.3 | Fixed | RHSA-2013:0533 |
| Red Hat JBoss Web Platform 5 for RHEL 5 Server | Fixed | RHSA-2013:0230 |
| Red Hat JBoss Web Platform 5 for RHEL 6 Server | Fixed | RHSA-2013:0230 |
| Red Hat JBoss Web Platform 5.2 | Fixed | RHSA-2013:0233 |
Not affected: 3 products
- Red Hat JBoss Operations Network 3
- Red Hat JBoss Web Platform 5 for RHEL 4 AS
- Red Hat JBoss Web Platform 5 for RHEL 4 ES
Timeline
- 2026-10-02 Threatist record created from CVE-2012-5629
- 2026-10-03 Alias added: GHSA-m4f6-9xf8-2whr
References
More Red Hat Jboss Enterprise Application Platform vulnerabilities
- TI-2017-08941 Deserialization of untrusted data in Red Hat jbossas KEVCVSS 3.1CRITICAL 9.8
- TI-2010-01790 JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for… KEVCVSS 3.1HIGH 8.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2010-01383 The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application… KEVCVSS 3.1HIGH 7.5
- TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
Sources
- CVE-2012-5629 · CVE Program
- CVE-2012-5629 · NVD
- FIRST EPSS
- GHSA-m4f6-9xf8-2whr · GitHub Advisory Database · CC BY 4.0
- CVE-2012-5629 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences