CVE-2016-8741

Severity
7.5HIGH
EPSS
0.5%
top 34.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedMay 15
Latest updateMay 17

Description

The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these AuthenticationProviders in Apache Qpid Broker for Java 6.0.x before 6.0.6 and 6.1.x before 6.1.1 prematurely terminate the SCRAM SASL negotiation if the provided user name does not exist thus allowing remote attacker to determine the existence of user a

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

Mavenorg.apache.qpid:qpid-broker6.0.06.0.6+1
NVDapache/qpid_broker-j6 versions+5
CVEListV5apache_software_foundation/apache_qpid_broker-j6.0.1, 6.0.2, 6.0.3, 6.0.4, and 6.0.5, 6.1.0+1

🔴Vulnerability Details

3
GHSA
Exposure of Sensitive Information to an Unauthorized Actor in Apache Qpid Broker for Java2022-05-17
OSV
Exposure of Sensitive Information to an Unauthorized Actor in Apache Qpid Broker for Java2022-05-17
CVEList
CVE-2016-8741: The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication2017-05-15

📋Vendor Advisories

1
Red Hat
qpid-java: Information leakage via specific AuthenticationProviders2016-12-28

💬Community

2
Bugzilla
CVE-2016-8741 qpid-java: Information leakage via specific AuthenticationProviders2017-01-03
Bugzilla
CVE-2016-8741 qpid-java: Information leakage via specific AuthenticationProviders [fedora-all]2017-01-03
CVE-2016-8741 (HIGH CVSS 7.5) | The Apache Qpid Broker for Java can | cvebase.io