Login Request a demo
Unscored severity · published Mar 14, 2013
CVE-2012-4446
The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which…
–
CVSS
4.9%
EPSS
No
On KEV
Description
The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.9% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QP
Qpid · Apache
through 0.20; 0.5; 0.6; 0.7; 0.8; 0.9; +10 more · source: NVD
Affected product
QP
Qpid
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-4446
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-4446
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0561.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0562.html
Vendor Advisory
http://secunia.com/advisories/52516
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=851355
issues.apache.org
https://issues.apache.org/jira/browse/QPID-4631
More from Qpid
7.5
CVE-2015-0224
qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted protocol sequence set
7.4
CVE-2019-0223
While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a…
6.5
CVE-2015-0203
The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service (daemon crash) via an AMQP message with (1) an invalid range in a…
–
CVE-2015-0223
Unspecified vulnerability in Apache Qpid 0.30 and earlier allows remote attackers to bypass access restrictions on qpidd via unknown vectors, related to 0-10 connection handling
–
CVE-2014-3629
XML external entity (XXE) vulnerability in the XML Exchange module in Apache Qpid 0.30 allows remote attackers to cause outgoing HTTP connections via a crafted message