GHSA-mrgh-6x42-x6xfMedium

Improper Authentication in Apache Qpid

Published
May 17, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2012-4446 →

📋 Description

The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.

🎯 Affected products1

  • maven/org.apache.qpid:qpid-client:< 0.20

🔗 References (6)