Authorization Bypass

2019-01-1508:50:58

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.007 Low

EPSS

Percentile

79.9%

JSON

qpid-cpp is vulnerable to authorization bypass attacks. The vulnerability exists as qpid-cpp does not properly verify credentials during the joining of a cluster. This allows remote attackers to obtain access to the messaging functionality and job functionality of a cluster by using a valid cluster-username.

CPENameOperatorVersion
qpid-javaeq0.2.687156__1.el5
qpid-javaeq0.5.751061__8.el5
qpid-javaeq0.10__9.el6
qpid-javaeq0.7.946106__11.el5
qpid-javaeq0.5.751061__2.el5
qpid-javaeq0.7.946106__15.el5
qpid-javaeq0.10__6.el6
qpid-javaeq0.10__9.el5
qpid-javaeq0.5.751061__7.el5
qpid-javaeq0.5.751061__9.el5

Name	Operator	Version
qpid-java	eq	0.2.687156__1.el5
qpid-java	eq	0.5.751061__8.el5
qpid-java	eq	0.10__9.el6
qpid-java	eq	0.7.946106__11.el5
qpid-java	eq	0.5.751061__2.el5
qpid-java	eq	0.7.946106__15.el5
qpid-java	eq	0.10__6.el6
qpid-java	eq	0.10__9.el5
qpid-java	eq	0.5.751061__7.el5
qpid-java	eq	0.5.751061__9.el5