CVE-2016-9877

CWE-284 — Improper Access ControlCWE-287 — Improper Authentication10 documents8 sources
Severity
9.8CRITICAL
EPSS
0.3%
top 44.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Broadcom Rabbitmq ServerPivotal Software Rabbitmq
Timeline
PublishedDec 29
Latest updateMay 13

Description

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶NVDpivotal_software/rabbitmq44 versions+43
▶Debianrabbitmq-server< 3.6.6-1+3
▶NVDbroadcom/rabbitmq_server32 versions+31

🔴Vulnerability Details

3
GHSA
GHSA-fjmp-8qvg-p73x: An issue was discovered in Pivotal RabbitMQ 3↗2022-05-13
▶
CVEList
CVE-2016-9877: An issue was discovered in Pivotal RabbitMQ 3↗2016-12-29
▶
OSV
CVE-2016-9877: An issue was discovered in Pivotal RabbitMQ 3↗2016-12-29
▶

📋Vendor Advisories

3
Ubuntu
RabbitMQ vulnerability↗2017-07-31
▶
Red Hat
rabbitmq: MQTT connection authentication succeeds with empty password↗2016-12-20
▶
Debian
CVE-2016-9877: rabbitmq-server - An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3....↗2016
▶

💬Community

3
Bugzilla
CVE-2016-9877 rabbitmq-server: rabbitmq: MQTT connection authentication succeeds with empty password [fedora-all]↗2017-01-03
▶
Bugzilla
CVE-2016-9877 rabbitmq: MQTT connection authentication succeeds with empty password↗2017-01-03
▶
Bugzilla
CVE-2016-9877 rabbitmq-server: rabbitmq: MQTT connection authentication succeeds with empty password [epel-all]↗2017-01-03
▶
CVE-2016-9877 (CRITICAL CVSS 9.8) | An issue was discovered in Pivotal | cvebase.io