CVE-2012-4446 Improper Authentication in Apache Qpid
MediumCVSS 6.8
EPSS 4.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.qpid/qpid-client(Maven) | < 0.20 | 0.20 |
| org.apache.qpid/qpid-client(Maven) | = 0.10 | No fix listed |
| org.apache.qpid/qpid-client(Maven) | = 0.12 | No fix listed |
| org.apache.qpid/qpid-client(Maven) | = 0.14 | No fix listed |
| org.apache.qpid/qpid-client(Maven) | = 0.16 | No fix listed |
| org.apache.qpid/qpid-client(Maven) | = 0.18 | No fix listed |
| apache qpid | <= 0.20 | No fix listed |
| apache qpid | = 0.5 | No fix listed |
| apache qpid | = 0.6 | No fix listed |
| apache qpid | = 0.7 | No fix listed |
| apache qpid | = 0.8 | No fix listed |
| apache qpid | = 0.9 | No fix listed |
| apache qpid | = 0.10 | No fix listed |
| apache qpid | = 0.11 | No fix listed |
| apache qpid | = 0.12 | No fix listed |
| apache qpid | = 0.13 | No fix listed |
| apache qpid | = 0.14 | No fix listed |
| apache qpid | = 0.15 | No fix listed |
| apache qpid | = 0.16 | No fix listed |
| apache qpid | = 0.17 | No fix listed |
| apache qpid | = 0.18 | No fix listed |
| apache qpid | = 0.19 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com
- issues.apache.org
- RHSA-2013:0561 vendor-advisory
- RHSA-2013:0562 vendor-advisory
- github.com
- 52516 third-party-advisory vendor-advisory