CVE-2016-3094

CWE-20 — Improper Input ValidationCWE-287 — Improper Authentication7 documents6 sources
Severity
5.9MEDIUM
EPSS
1.0%
top 23.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Apache Qpid Broker-j
Timeline
PublishedJun 1
Latest updateOct 16

Description

PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.2 | Impact: 3.6

Affected Packages2 packages

🔴Vulnerability Details

4
OSV
Improper Input Validation in org.apache.qpid:qpid-broker↗2018-10-16
▶
GHSA
Improper Input Validation in org.apache.qpid:qpid-broker↗2018-10-16
▶
OSV
CVE-2016-3094: PlainSaslServer↗2016-06-01
▶
CVEList
CVE-2016-3094: PlainSaslServer↗2016-06-01
▶

📋Vendor Advisories

1
Red Hat
qpid-java: crash in PLAIN SASL handler on malformed SASL response↗2016-05-27
▶

💬Community

1
Bugzilla
CVE-2016-3094 qpid-java: crash in PLAIN SASL handler on malformed SASL response↗2016-05-19
▶
CVE-2016-3094 (MEDIUM CVSS 5.9) | PlainSaslServer.java in Apache Qpid | cvebase.io