Auth bypass in Apache Qpid

CVE-2012-3467

Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.

Vulnerability class: Broken Authentication

EPSS: 0.064 (92.9th percentile) — read the EPSS interpretation.

Affected products

  • Apache Qpid — versions 0.5, 0.6, 0.14
  • N/a — versions n/a

Weakness classification (CWE)

References