GitHub Advisoryadvisory · Maven

GHSA-phw8-fw9g-v3xc Apache QPID Allows Remote Authentication Bypass

MEDIUM Published 2022-05-17 Modified 2023-08-29 Official page ↗
Aliases
CVE-2012-3467
Ecosystem
Maven
Packages
org.apache.qpid:qpid-parent
Severity
Moderate
Weaknesses
CWE-287
Reviewed
2023-08-29

Affected packages

• Maven org.apache.qpid:qpid-parent: < 0.17 → fixed in 0.17

Description

Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.

Related

Alias · CVE (1)

  • CVE-2012-3467 Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References