CVEvulnerability

CVE-2016-9877

9.8 CRITICAL Published 2016-12-29 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-12-29
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-284

Description

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.

Affected configurations

• broadcom rabbitmq server 3.0.0 • broadcom rabbitmq server 3.0.1 • broadcom rabbitmq server 3.0.2 • broadcom rabbitmq server 3.0.3 • broadcom rabbitmq server 3.0.4 • broadcom rabbitmq server 3.1.0 • broadcom rabbitmq server 3.1.1 • broadcom rabbitmq server 3.1.2 • broadcom rabbitmq server 3.1.3 • broadcom rabbitmq server 3.1.4 • broadcom rabbitmq server 3.1.5 • broadcom rabbitmq server 3.2.0 • broadcom rabbitmq server 3.2.1 • broadcom rabbitmq server 3.2.2 • broadcom rabbitmq server 3.2.3 • broadcom rabbitmq server 3.2.4 • broadcom rabbitmq server 3.3.0 • broadcom rabbitmq server 3.3.1 • broadcom rabbitmq server 3.3.2 • broadcom rabbitmq server 3.3.3 • broadcom rabbitmq server 3.3.4 • broadcom rabbitmq server 3.3.5 • broadcom rabbitmq server 3.4.0 • broadcom rabbitmq server 3.4.1 • broadcom rabbitmq server 3.4.2 • broadcom rabbitmq server 3.4.3 • broadcom rabbitmq server 3.4.4 • broadcom rabbitmq server 3.5.0 • broadcom rabbitmq server 3.5.1 • broadcom rabbitmq server 3.5.2 • broadcom rabbitmq server 3.5.3 • broadcom rabbitmq server 3.5.6 • pivotal software rabbitmq 3.5.4 • pivotal software rabbitmq 3.5.5 • pivotal software rabbitmq 3.5.7 • pivotal software rabbitmq 3.6.0 • pivotal software rabbitmq 3.6.1 • pivotal software rabbitmq 3.6.2 • pivotal software rabbitmq 3.6.3 • pivotal software rabbitmq 3.6.4 • pivotal software rabbitmq 3.6.5 • pivotal software rabbitmq 1.5.0 • pivotal software rabbitmq 1.5.1 • pivotal software rabbitmq 1.5.2 • pivotal software rabbitmq 1.5.3 • pivotal software rabbitmq 1.5.4 • pivotal software rabbitmq 1.5.5 • pivotal software rabbitmq 1.5.6 • pivotal software rabbitmq 1.5.7 • pivotal software rabbitmq 1.5.8 • pivotal software rabbitmq 1.5.9 • pivotal software rabbitmq 1.5.10 • pivotal software rabbitmq 1.5.11 • pivotal software rabbitmq 1.5.12 • pivotal software rabbitmq 1.5.13 • pivotal software rabbitmq 1.5.14 • pivotal software rabbitmq 1.5.15 • pivotal software rabbitmq 1.5.17 • pivotal software rabbitmq 1.5.18 • pivotal software rabbitmq 1.6.0 … and 16 more

Related

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References