CVE-2016-9877

Description

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.

Related CPE's

avmwarerabbitmq3.5.2*******

avmwarerabbitmq3.5.3*******

apivotal_softwarerabbitmq3.5.4*******

apivotal_softwarerabbitmq3.6.3*******

apivotal_softwarerabbitmq3.6.4*******

avmwarerabbitmq3.1.0*******

avmwarerabbitmq3.1.1*******

avmwarerabbitmq3.2.2*******

avmwarerabbitmq3.2.3*******

avmwarerabbitmq3.2.4*******

References

https://pivotal.io/security/cve-2016-9877

MitigationVendor Advisory

95065

DSA-3761

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03880en_us

CvssV3 impact

BaseSeverity

CRITICAL

ConfidentialityImpact

HIGH

AttackComplexity

LOW

Scope

UNCHANGED

AttackVector

NETWORK

AvailabilityImpact

HIGH

IntegrityImpact

HIGH

PrivilegesRequired

NONE

BaseScore

9.8

VectorString

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Version

3.0

UserInteraction

NONE

CvssV2 impact

Version

2.0

VectorString

AV:N/AC:L/Au:N/C:P/I:P/A:P

AccessVector

NETWORK

AccessComplexity

LOW

Authentication

NONE

ConfidentialityImpact

PARTIAL

IntegrityImpact

PARTIAL

AvailabilityImpact

PARTIAL

BaseScore

7.5

Created by Yello
About Severity.io