GHSA-mrgh-6x42-x6xf

ghsaUSosv

Improper Authentication in Apache Qpid

view advisory published 2022-05-17Licence: CC-BY-4.0

The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2012-4446US	medium6.8	4.91% (92nd)	—	2013-03-14
The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows…

references

External citations — patches, advisories, analysis.

http://rhn.redhat.com/errata/RHSA-2013-0561.htmlWEB
http://rhn.redhat.com/errata/RHSA-2013-0562.htmlWEB
https://bugzilla.redhat.com/show_bug.cgi?id=851355WEB
https://issues.apache.org/jira/browse/QPID-4631WEB
https://nvd.nist.gov/vuln/detail/CVE-2012-4446ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan