GitHub Advisoryadvisory · Maven

GHSA-mrgh-6x42-x6xf Improper Authentication in Apache Qpid

MEDIUM Published 2022-05-17 Modified 2022-07-13 Official page ↗
Aliases
CVE-2012-4446
Ecosystem
Maven
Packages
org.apache.qpid:qpid-client
Severity
Moderate
Weaknesses
CWE-287
Reviewed
2022-07-13

Affected packages

• Maven org.apache.qpid:qpid-client: < 0.20 → fixed in 0.20

Description

The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.

Related

Alias · CVE (1)

  • CVE-2012-4446 The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References