PT-2017-14151 · Apache · Apache Qpid Broker-J

Published 2017-12-01 · Updated 2023-05-22 · CVE-2017-15702

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Qpid Broker-J versions 0.18 through 0.32

Description The issue allows a remote unauthenticated attacker to trick the broker into using an authentication provider configured on a different port when connecting to an HTTP port. This becomes a problem when the spoofed port has weaker authentication protection, such as anonymous access or default accounts, which can be circumvented by this issue. The attacker still needs valid credentials with the authentication provider on the spoofed port. AMQP ports are not affected.

Recommendations For Apache Qpid Broker-J versions 0.18 through 0.32, update to version 6.0.0 or newer to resolve the issue.

Fix

Related Identifiers

CVE-2017-15702

GHSA-269M-695X-J34P

Affected Products

Apache Qpid Broker-J

References · 11

• https://osv.dev/vulnerability/GHSA-269m-695x-j34p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15702 · Security Note
• https://qpid.apache.org/cves/CVE-2017-15702.html · Vendor Advisory
• https://issues.apache.org/jira/browse/QPID-8039 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-15702 · Vendor Advisory
• https://github.com/apache/qpid-broker-j · Note
• https://github.com/advisories/GHSA-269m-695x-j34p · Note
• https://lists.apache.org/thread.html/59d241e30db23b8b0af26bb273f789aa1f08515d3dc1a3868d3ba090@%3Cdev.qpid.apache.org%3E · Note
• http://securityfocus.com/bid/102040 · Note
• https://lists.apache.org/thread.html/59d241e30db23b8b0af26bb273f789aa1f08515d3dc1a3868d3ba090%40%3Cdev.qpid.apache.org%3E · Note
• https://t.me/cvenotify/50920 · Telegram Post