CVE-2012-4446
Last modified
CVE-2012-4446 is a vulnerability of currently unknown severity. The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.. EPSS estimates a 4.91% chance of exploitation in the next 30 days.
Description
The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Qpid | <= 0.20 |
| Apache | Qpid | 0.5 |
| Apache | Qpid | 0.6 |
| Apache | Qpid | 0.7 |
| Apache | Qpid | 0.8 |
| Apache | Qpid | 0.9 |
| Apache | Qpid | 0.10 |
| Apache | Qpid | 0.11 |
| Apache | Qpid | 0.12 |
| Apache | Qpid | 0.13 |
| Apache | Qpid | 0.14 |
| Apache | Qpid | 0.15 |
| Apache | Qpid | 0.16 |
| Apache | Qpid | 0.17 |
| Apache | Qpid | 0.18 |
| Apache | Qpid | 0.19 |
References
- http://secunia.com/advisories/52516Vendor Advisory
- http://secunia.com/advisories/52516Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2012-4446?
How severe is CVE-2012-4446?
How do I fix CVE-2012-4446?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2012
- CVE-2012-4440Cross-site Scripting (XSS) in Jenkins main before 1.482 and …6.1
- CVE-2012-4441Cross-site Scripting (XSS) in Jenkins main before 1.482 and …6.1
- CVE-2012-4442Monkey HTTP Daemon 0.9.3 retains the supplementary group IDs…
- CVE-2012-4443Monkey HTTP Daemon 0.9.3 uses a real UID of root and a real …
- CVE-2012-4444The ip6_frag_queue function in net/ipv6/reassembly.c in the …
- CVE-2012-4445Heap-based buffer overflow in the eap_server_tls_process_fra…
- CVE-2012-4447Heap-based buffer overflow in tif_pixarlog.c in LibTIFF befo…
- CVE-2012-4448Cross-site request forgery (CSRF) vulnerability in wp-admin/…
- CVE-2012-4449Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x befor…
- CVE-2012-4450389 Directory Server 1.2.10 does not properly update the ACL…
- CVE-2012-4451Multiple cross-site scripting (XSS) vulnerabilities in Zend …6.1
- CVE-2012-4452MySQL 5.0.88, and possibly other versions and platforms, all…
Are you affected by CVE-2012-4446?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST