CVE-2016-3094

MEDIUM

Apache Qpid Broker-j < 6.0.2 - Authentication Bypass

Title source: rule

Description

PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception.

References (7)

[Vendor Advisory] http://mail-archives.apache.org/mod_mbox/qpid-users/201605.mbox/%3C5748641A.2050701%40gmail.com%3E

[Third Party Advisory, VDB Entry] http://packetstormsecurity.com/files/137215/Apache-Qpid-Java-Broker-6.0.2-Denial-Of-Service.html

[Release Notes] http://qpid.apache.org/releases/qpid-java-6.0.3/release-notes.html

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/538507/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1035982

[Vendor Advisory] https://issues.apache.org/jira/browse/QPID-7271

[Release Notes] https://svn.apache.org/viewvc?view=revision&revision=1744403

Scores

CVSS v3 5.9

EPSS 0.0099

EPSS Percentile 76.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Classification

CWE

CWE-287 CWE-20

Status draft

Affected Products (2)

apache/qpid_broker-j < 6.0.2

org.apache.qpid/qpid-broker < 6.0.3Maven

Timeline

Published Jun 01, 2016

Tracked Since Feb 18, 2026