CVE-2016-4432

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-4432
The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://mail-archives.apache.org/mod_mbox/qpid-users/201605.mbox/%3CCAFEMS4tXDKYxKVMmU0zTb_7uzduoUS4_RePnUwz1tj%2BGQLNw5Q%40mail.gmail.com%3E Vendor Advisory
http://packetstormsecurity.com/files/137216/Apache-Qpid-Java-Broker-6.0.2-Authentication-Bypass.html Third Party Advisory VDB Entry
http://www.securityfocus.com/archive/1/538508/100/0/threaded Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1035983 Broken Link Third Party Advisory VDB Entry
https://issues.apache.org/jira/browse/QPID-7257 Issue Tracking Vendor Advisory
https://svn.apache.org/viewvc?view=revision&revision=1743161 Patch Vendor Advisory
https://svn.apache.org/viewvc?view=revision&revision=1743393 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:qpid_broker-j:*:*:*:*:*:*:*:*
History

07 Dec 2022, 16:39

Type Values Removed Values Added
First Time Apache qpid Broker-j
References (BUGTRAQ) http://www.securityfocus.com/archive/1/538508/100/0/threaded - (BUGTRAQ) http://www.securityfocus.com/archive/1/538508/100/0/threaded - Third Party Advisory, VDB Entry
References (CONFIRM) https://svn.apache.org/viewvc?view=revision&revision=1743161 - (CONFIRM) https://svn.apache.org/viewvc?view=revision&revision=1743161 - Patch, Vendor Advisory
References (CONFIRM) https://svn.apache.org/viewvc?view=revision&revision=1743393 - (CONFIRM) https://svn.apache.org/viewvc?view=revision&revision=1743393 - Patch, Vendor Advisory
References (CONFIRM) https://issues.apache.org/jira/browse/QPID-7257 - (CONFIRM) https://issues.apache.org/jira/browse/QPID-7257 - Issue Tracking, Vendor Advisory
References (MISC) http://packetstormsecurity.com/files/137216/Apache-Qpid-Java-Broker-6.0.2-Authentication-Bypass.html - (MISC) http://packetstormsecurity.com/files/137216/Apache-Qpid-Java-Broker-6.0.2-Authentication-Bypass.html - Third Party Advisory, VDB Entry
References (SECTRACK) http://www.securitytracker.com/id/1035983 - (SECTRACK) http://www.securitytracker.com/id/1035983 - Broken Link, Third Party Advisory, VDB Entry
CPE cpe:2.3:a:apache:qpid_java:*:*:*:*:*:*:*:* cpe:2.3:a:apache:qpid_broker-j:*:*:*:*:*:*:*:*
Information

Published : 2016-06-01 20:59

Updated : 2023-12-10 11:46

NVD link : CVE-2016-4432

Mitre link : CVE-2016-4432

CVE.ORG link : CVE-2016-4432

JSON object : View

Products Affected

apache

  • qpid_broker-j
CWE
CWE-287

Improper Authentication