Every CVE Search/ Get API key

CVE-2012-4446

Improper Authentication in Apache Qpid

6.8 MediumFix available

The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.

Exploit likelihood

4.91%Up 3.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.8

The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.

Record
CVE-2012-4446
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-287
Updated
2026-11-02
CVE List No score

The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.

Record
CVE-2012-4446
Updated
2026-11-02
EUVDEUVD-2022-4620 No score

The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.

Record
EUVD-2022-4620
Updated
2026-11-03
GitHub AdvisoriesGHSA-mrgh-6x42-x6xf No score

Improper Authentication in Apache Qpid

The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.

Record
GHSA-mrgh-6x42-x6xf
Weakness
CWE-287
Updated
2026-11-02
OSVGHSA-mrgh-6x42-x6xf No score

Improper Authentication in Apache Qpid

The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.

Record
GHSA-mrgh-6x42-x6xf
Weakness
CWE-287
Updated
2026-11-02
OSVUBUNTU-CVE-2012-4446 No score

The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.

Record
UBUNTU-CVE-2012-4446
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.qpid:qpid-client
Maven
 before 0.20
0.20
org.apache.qpid:qpid-client
Maven
 before 0.20, plus listed versions
0.100.120.140.160.18
0.20
mrg-release
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:2.3.0-1.el5
0:2.3.0-1.el5
cumin-messaging
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.1.1-2.el5
0:0.1.1-2.el5
python-qpid
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-4.el5
0:0.18-4.el5
python-qpid-qmf
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-15.el5
0:0.18-15.el5
python-saslwrapper
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-1.el5
0:0.18-1.el5
qpid-cpp-client
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-14.el5
0:0.18-14.el5
qpid-cpp-client-devel
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-14.el5
0:0.18-14.el5
qpid-cpp-client-devel-docs
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-14.el5
0:0.18-14.el5
Show 104 moreShow less
Affected packages
PackageAffectedFixed
qpid-cpp-client-rdma
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-14.el5
0:0.18-14.el5
qpid-cpp-client-ssl
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-14.el5
0:0.18-14.el5
qpid-cpp-mrg
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-14.el5
0:0.18-14.el5
qpid-cpp-mrg-debuginfo
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-14.el5
0:0.18-14.el5
qpid-cpp-server
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-14.el5
0:0.18-14.el5
qpid-cpp-server-cluster
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-14.el5
0:0.18-14.el5
qpid-cpp-server-devel
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-14.el5
0:0.18-14.el5
qpid-cpp-server-rdma
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-14.el5
0:0.18-14.el5
qpid-cpp-server-ssl
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-14.el5
0:0.18-14.el5
qpid-cpp-server-store
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-14.el5
0:0.18-14.el5
qpid-cpp-server-xml
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-14.el5
0:0.18-14.el5
qpid-java
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-7.el5
0:0.18-7.el5
qpid-java-client
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-7.el5
0:0.18-7.el5
qpid-java-common
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-7.el5
0:0.18-7.el5
qpid-java-example
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-7.el5
0:0.18-7.el5
qpid-jca
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-8.el5
0:0.18-8.el5
qpid-jca-xarecovery
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-8.el5
0:0.18-8.el5
qpid-qmf
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-15.el5
0:0.18-15.el5
qpid-qmf-debuginfo
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-15.el5
0:0.18-15.el5
qpid-qmf-devel
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-15.el5
0:0.18-15.el5
qpid-tests
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-2.el5
0:0.18-2.el5
qpid-tools
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-8.el5
0:0.18-8.el5
rhm-docs
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-2.el5
0:0.18-2.el5
ruby-qpid-qmf
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-15.el5
0:0.18-15.el5
ruby-saslwrapper
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-1.el5
0:0.18-1.el5
saslwrapper
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-1.el5
0:0.18-1.el5
saslwrapper-debuginfo
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-1.el5
0:0.18-1.el5
saslwrapper-devel
Red Hat:enterprise_mrg:2::el5
From an advisory covering 3 CVEs
 before 0:0.18-1.el5
0:0.18-1.el5
mrg-release
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:2.3.0-1.el6
0:2.3.0-1.el6
python-qpid
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:0.18-4.el6
0:0.18-4.el6
python-qpid-qmf
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:0.18-15.el6
0:0.18-15.el6
python-saslwrapper
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:0.18-1.el6_3
0:0.18-1.el6_3
qpid-cpp
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:0.18-14.el6
0:0.18-14.el6
qpid-cpp-client
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:0.18-14.el6
0:0.18-14.el6
qpid-cpp-client-ssl
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:0.18-14.el6
0:0.18-14.el6
qpid-cpp-debuginfo
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:0.18-14.el6
0:0.18-14.el6
qpid-cpp-server
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:0.18-14.el6
0:0.18-14.el6
qpid-cpp-server-ssl
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:0.18-14.el6
0:0.18-14.el6
qpid-qmf
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:0.18-15.el6
0:0.18-15.el6
qpid-qmf-debuginfo
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:0.18-15.el6
0:0.18-15.el6
qpid-tests
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:0.18-2.el6
0:0.18-2.el6
qpid-tools
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:0.18-8.el6
0:0.18-8.el6
ruby-qpid-qmf
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:0.18-15.el6
0:0.18-15.el6
ruby-saslwrapper
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:0.18-1.el6_3
0:0.18-1.el6_3
rubygem-rake
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:0.8.7-2.1.el6
0:0.8.7-2.1.el6
rubygems
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:1.8.16-1.el6
0:1.8.16-1.el6
saslwrapper
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:0.18-1.el6_3
0:0.18-1.el6_3
saslwrapper-debuginfo
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:0.18-1.el6_3
0:0.18-1.el6_3
saslwrapper-devel
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:0.18-1.el6_3
0:0.18-1.el6_3
xerces-c
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:3.0.1-20.el6
0:3.0.1-20.el6
xerces-c-debuginfo
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:3.0.1-20.el6
0:3.0.1-20.el6
xerces-c-devel
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:3.0.1-20.el6
0:3.0.1-20.el6
xerces-c-doc
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:3.0.1-20.el6
0:3.0.1-20.el6
xqilla
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:2.2.3-8.el6
0:2.2.3-8.el6
xqilla-debuginfo
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:2.2.3-8.el6
0:2.2.3-8.el6
xqilla-devel
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:2.2.3-8.el6
0:2.2.3-8.el6
xqilla-doc
Red Hat:enterprise_mrg:2:computenode:el6
From an advisory covering 3 CVEs
 before 0:2.2.3-8.el6
0:2.2.3-8.el6
mrg-release
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:2.3.0-1.el6
0:2.3.0-1.el6
rubygem-rake
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.8.7-2.1.el6
0:0.8.7-2.1.el6
rubygems
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:1.8.16-1.el6
0:1.8.16-1.el6
cumin-messaging
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.1.1-2.el6
0:0.1.1-2.el6
python-qpid
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-4.el6
0:0.18-4.el6
python-qpid-qmf
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-15.el6
0:0.18-15.el6
python-saslwrapper
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-1.el6_3
0:0.18-1.el6_3
qpid-cpp
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-14.el6
0:0.18-14.el6
qpid-cpp-client
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-14.el6
0:0.18-14.el6
qpid-cpp-client-devel
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-14.el6
0:0.18-14.el6
qpid-cpp-client-devel-docs
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-14.el6
0:0.18-14.el6
qpid-cpp-client-rdma
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-14.el6
0:0.18-14.el6
qpid-cpp-client-ssl
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-14.el6
0:0.18-14.el6
qpid-cpp-debuginfo
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-14.el6
0:0.18-14.el6
qpid-cpp-server
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-14.el6
0:0.18-14.el6
qpid-cpp-server-cluster
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-14.el6
0:0.18-14.el6
qpid-cpp-server-devel
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-14.el6
0:0.18-14.el6
qpid-cpp-server-rdma
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-14.el6
0:0.18-14.el6
qpid-cpp-server-ssl
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-14.el6
0:0.18-14.el6
qpid-cpp-server-store
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-14.el6
0:0.18-14.el6
qpid-cpp-server-xml
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-14.el6
0:0.18-14.el6
qpid-java
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-7.el6
0:0.18-7.el6
qpid-java-client
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-7.el6
0:0.18-7.el6
qpid-java-common
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-7.el6
0:0.18-7.el6
qpid-java-example
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-7.el6
0:0.18-7.el6
qpid-jca
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-8.el6
0:0.18-8.el6
qpid-jca-xarecovery
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-8.el6
0:0.18-8.el6
qpid-qmf
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-15.el6
0:0.18-15.el6
qpid-qmf-debuginfo
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-15.el6
0:0.18-15.el6
qpid-qmf-devel
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-15.el6
0:0.18-15.el6
qpid-tests
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-2.el6
0:0.18-2.el6
qpid-tools
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-8.el6
0:0.18-8.el6
rhm-docs
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-2.el6
0:0.18-2.el6
ruby-qpid-qmf
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-15.el6
0:0.18-15.el6
ruby-saslwrapper
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-1.el6_3
0:0.18-1.el6_3
saslwrapper
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-1.el6_3
0:0.18-1.el6_3
saslwrapper-debuginfo
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-1.el6_3
0:0.18-1.el6_3
saslwrapper-devel
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:0.18-1.el6_3
0:0.18-1.el6_3
xerces-c
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:3.0.1-20.el6
0:3.0.1-20.el6
xerces-c-debuginfo
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:3.0.1-20.el6
0:3.0.1-20.el6
xerces-c-devel
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:3.0.1-20.el6
0:3.0.1-20.el6
xerces-c-doc
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:3.0.1-20.el6
0:3.0.1-20.el6
xqilla
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:2.2.3-8.el6
0:2.2.3-8.el6
xqilla-debuginfo
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:2.2.3-8.el6
0:2.2.3-8.el6
xqilla-devel
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:2.2.3-8.el6
0:2.2.3-8.el6
xqilla-doc
Red Hat:enterprise_mrg:2:server:el6
From an advisory covering 3 CVEs
 before 0:2.2.3-8.el6
0:2.2.3-8.el6
qpid-cpp
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.16-9build10.16-9ubuntu10.16-9ubuntu2
 None known

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-4446 is a medium vulnerability (CVSS 6.8) in Apache Qpid, published March 12, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.91%, the 92nd percentile. Fixed in org.apache.qpid:qpid-client 0.20.

References

Show 60 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open