CVE-2012-5629

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform (EAP) versions 4.3.0 CP10 through 6.0.1 JBoss Enterprise Web Platform (EWP) version 5.2.0

Description The default configuration of the LdapLoginModule and LdapExtLoginModule modules allows remote attackers to bypass authentication via an empty password.

Recommendations For JBoss Enterprise Application Platform (EAP) versions 4.3.0 CP10 through 6.0.1, update the configuration to disallow empty passwords. For JBoss Enterprise Web Platform (EWP) version 5.2.0, update the configuration to disallow empty passwords. As a temporary workaround, consider disabling the LdapLoginModule and LdapExtLoginModule modules until a proper configuration update can be applied.