CVE-2016-9877

CRITICAL

RabbitMQ 3.x < 3.5.8 and 3.6.x < 3.6.6 - Unauthenticated MQTT Connection Authentication Bypass

Title source: llm
STIX 2.1

Description

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/95065
Mitigation, Vendor Advisory x_refsource_confirm
https://pivotal.io/security/cve-2016-9877
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2017/dsa-3761

Scores

CVSS v3 9.8
EPSS 0.0033
EPSS Percentile 56.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-284
Status published
Products (50)
broadcom/rabbitmq_server 3.0.0
broadcom/rabbitmq_server 3.0.1
broadcom/rabbitmq_server 3.0.2
broadcom/rabbitmq_server 3.0.3
broadcom/rabbitmq_server 3.0.4
broadcom/rabbitmq_server 3.1.0
broadcom/rabbitmq_server 3.1.1
broadcom/rabbitmq_server 3.1.2
broadcom/rabbitmq_server 3.1.3
broadcom/rabbitmq_server 3.1.4
... and 40 more
Published Dec 29, 2016
Tracked Since Feb 18, 2026