ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind

Summary

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.

Timeline

1. Jan 27, 2021, 12:00 AM UTCCVE published
2. Aug 3, 2024, 8:19 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache ActiveMQ

  fixed in 2.16.0; fixed in 5.15.14

• org.apache.activemq:activemq-parentMaven

  From 5.16.0 · fixed in 5.16.1

• org.apache.activemq:activemq-parentMaven

  fixed in 5.15.14

• org.apache.activemq:apache-artemisMaven

  fixed in 2.16.0

References 21