CVE-2012-4446
Apache Qpid < 0.20 - Unauthenticated Authentication Bypass via AMQP Federation Tag
Title source: llmDescription
The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.
References (5)
Core 5
Core References
Various Sources x_refsource_confirm
https://issues.apache.org/jira/browse/QPID-4631
Vendor Advisory vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0561.html
Vendor Advisory vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0562.html
Issue Tracking x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=851355
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/52516
Scores
EPSS
0.0491
EPSS Percentile
91.0%
Details
CWE
CWE-287
Status
published
Products (17)
apache/qpid
0.5
apache/qpid
0.6
apache/qpid
0.7
apache/qpid
0.8
apache/qpid
0.9
apache/qpid
0.10
apache/qpid
0.11
apache/qpid
0.12
apache/qpid
0.13
apache/qpid
0.14
... and 7 more
Published
Mar 14, 2013
Tracked Since
Feb 18, 2026