Information Disclosure in Apache Qpid Broker for Java Authentication Providers
CVE-2016-8741
7.5HIGH
What is CVE-2016-8741?
The Apache Qpid Broker for Java is vulnerable due to its handling of user authentication via SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProviders. When the provided username does not exist, these AuthenticationProviders can prematurely terminate the SASL negotiation. This flaw enables a remote attacker to ascertain the existence of user accounts, compromising the confidentiality of user credentials and potentially exposing sensitive information. It is important to note that this vulnerability does not extend to other AuthenticationProviders outside SCRAM-SHA-1 and SCRAM-SHA-256.
Affected Version(s)
Apache Qpid Broker-J 6.0.1, 6.0.2, 6.0.3, 6.0.4, and 6.0.5
Apache Qpid Broker-J 6.1.0