Authentication Bypass

2019-01-1508:57:42

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.002 Low

EPSS

Percentile

64.8%

JSON

qpid is vulnerable to authentication bypass attacks. The vulnerability exists as Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.

CPENameOperatorVersion
qpid-cppeq0.10__6.el6
qpid-cppeq0.14__16.el6
qpid-cppeq0.7.946106__5.el6
qpid-cppeq0.10__3.el6
qpid-cppeq0.12__6.el6
qpid-cppeq0.10__8.el6_1
qpid-cppeq0.14__14.el6_2
qpid-jcaeq0.14__9.el5
qpid-jcaeq0.14__9.el6
qpid-qmfeq0.14__9.el5

Name	Operator	Version
qpid-cpp	eq	0.10__6.el6
qpid-cpp	eq	0.14__16.el6
qpid-cpp	eq	0.7.946106__5.el6
qpid-cpp	eq	0.10__3.el6
qpid-cpp	eq	0.12__6.el6
qpid-cpp	eq	0.10__8.el6_1
qpid-cpp	eq	0.14__14.el6_2
qpid-jca	eq	0.14__9.el5
qpid-jca	eq	0.14__9.el6
qpid-qmf	eq	0.14__9.el5