CVE-2012-3467
published 2012-08-27CVE-2012-3467: Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote…
PriorityP341medium5CVSS 2.0
AVNACLAuNCNIPAN
EPSS
6.39%
92.9th percentile
Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | qpid | <= 0.16 | — |
| apache | qpid | — | — |
| apache | qpid | — | — |
| apache | qpid | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache QPID Allows Remote Authentication Bypass
ghsa·2022-05-17
CVE-2012-3467 [MEDIUM] CWE-287 Apache QPID Allows Remote Authentication Bypass
Apache QPID Allows Remote Authentication Bypass
Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.
OSV
Apache QPID Allows Remote Authentication Bypass
osv·2022-05-17
CVE-2012-3467 [MEDIUM] Apache QPID Allows Remote Authentication Bypass
Apache QPID Allows Remote Authentication Bypass
Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.
Red Hat
qpid-cpp-server-cluster: unauthorized broker access caused by the use of NullAuthenticator catch-up shadow connections
vendor_redhat·2012-06-22·CVSS 5.0
CVE-2012-3467 [MEDIUM] qpid-cpp-server-cluster: unauthorized broker access caused by the use of NullAuthenticator catch-up shadow connections
qpid-cpp-server-cluster: unauthorized broker access caused by the use of NullAuthenticator catch-up shadow connections
Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.
Package: mingw32-qpid-cpp (Red Hat Enterprise Linux 6) - Not affected
Package: qpid-cpp (Red Hat Enterprise Linux 6) - Not affected
No detection rules found.
No public exploits indexed.
http://rhn.redhat.com/errata/RHSA-2012-1277.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1279.htmlhttp://secunia.com/advisories/50186http://secunia.com/advisories/50698http://svn.apache.org/viewvc?view=revision&revision=1352992http://www.openwall.com/lists/oss-security/2012/08/09/6http://www.securityfocus.com/bid/54954https://bugzilla.redhat.com/show_bug.cgi?id=836276https://exchange.xforce.ibmcloud.com/vulnerabilities/77568https://issues.apache.org/jira/browse/QPID-3849http://rhn.redhat.com/errata/RHSA-2012-1277.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1279.htmlhttp://secunia.com/advisories/50186http://secunia.com/advisories/50698http://svn.apache.org/viewvc?view=revision&revision=1352992http://www.openwall.com/lists/oss-security/2012/08/09/6http://www.securityfocus.com/bid/54954https://bugzilla.redhat.com/show_bug.cgi?id=836276https://exchange.xforce.ibmcloud.com/vulnerabilities/77568https://issues.apache.org/jira/browse/QPID-3849
2012-08-27
Published