Information disclosure in Apache Qpid Broker-J
CVE-2016-8741
The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these AuthenticationProviders in Apache Qpid Broker for Java 6.0.x before 6.0.6 and 6.1.x before 6.1.1 prematurely terminate the SCRAM SASL negotiation if the provided user name does not exist thus allowing remote attacker to determine the existence of user accounts. The Vulnerability does not apply to AuthenticationProviders other than SCRAM-SHA-1 and SCRAM-SHA-256.
Vulnerability class: Information Disclosure
EPSS: 0.063 (92.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Apache Qpid_broker-j — versions 6.0.1, 6.0.2, 6.0.3
- Apache Software Foundation Qpid Broker-j — versions 6.1.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, and 6.0.5
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK, Broken Link)
- security@apache.org (x_refsource_CONFIRM, Issue Tracking)
- security@apache.org (VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_BID)
- security@apache.org (Vendor Advisory, mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2016-8741?
- CVE-2016-8741 is a high-severity vulnerability in Apache Qpid Broker-J, classified under Information Disclosure. CVSS score: 7.5/10. Published 2017-05-15.
- How severe is CVE-2016-8741?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2016-8741 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.