Description

The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.

Remediation

References

http://rhn.redhat.com/errata/RHSA-2013-0561.html

http://rhn.redhat.com/errata/RHSA-2013-0562.html

http://secunia.com/advisories/52516

https://bugzilla.redhat.com/show_bug.cgi?id=851355

https://issues.apache.org/jira/browse/QPID-4631

Related Vulnerabilities

CVE-2022-42468 Vulnerability in maven package org.apache.flume.flume-ng-sources:flume-jms-source

CVE-2020-2111 Vulnerability in maven package org.jenkins-ci.plugins:subversion

CVE-2023-5217 Vulnerability in npm package electron

CVE-2022-43441 Vulnerability in maven package org.webjars.npm:sqlite3

CVE-2017-16153 Vulnerability in npm package gaoxuyan

Severity

Critical

Classification

CWE-287

Tags

Vendor Advisory