CVE-2017-15702

Name of the Vulnerable Software and Affected Versions Apache Qpid Broker-J versions 0.18 through 0.32

Description The issue allows a remote unauthenticated attacker to trick the broker into using an authentication provider configured on a different port when connecting to an HTTP port. This becomes a problem when the spoofed port has weaker authentication protection, such as anonymous access or default accounts, which can be circumvented by this issue. The attacker still needs valid credentials with the authentication provider on the spoofed port. AMQP ports are not affected.

Recommendations For Apache Qpid Broker-J versions 0.18 through 0.32, update to version 6.0.0 or newer to resolve the issue.