{"id":"CVE-2020-16971","aliases":["EUVD-2022-3213","GHSA-8q69-pw39-hpqh"],"status":"published","title":"Azure SDK for Java Security Feature Bypass Vulnerability","description":"Azure SDK for Java Security Feature Bypass Vulnerability","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.04266,"percentile":0.91146,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2020-12-09T23:36:37Z","modified":"2026-09-10T03:49:31Z","fixes":[{"ecosystem":"Maven","package":"com.microsoft.azure:azure-eventhubs","fixed_in":["3.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"com.azure:azure-core-amqp","fixed_in":["1.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.microsoft.azure:azure-eventhubs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.azure:azure-core-amqp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.microsoft.azure:azure-eventhubs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1"}]}],"versions":["0.10.0","0.11.0","0.12.0","0.13.0","0.13.1","0.14.0","0.14.2","0.14.3","0.14.4","0.14.5","0.15.0","0.15.1","0.16.0-PREVIEW","0.6.0","0.6.3","0.6.4","0.6.5","0.6.6","0.6.7","0.6.8","0.6.9","0.7.0","0.7.1","0.7.2","0.7.5","0.7.7","0.7.8","0.8.0","0.8.1","0.8.2","0.9.0","1.0.0","1.0.1","1.0.2","1.1.0","1.2.0","1.2.1","1.3.0","2.0.0","2.1.0","2.2.0","2.3.0","2.3.1","2.3.2","3.0.0","3.0.1","3.0.2","3.1.0","3.1.1","3.2.0"]},{"source":"osv","ecosystem":"Maven","package":"com.azure:azure-core-amqp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}],"versions":["1.0.0-beta.8","1.0.0-preview.1","1.0.0-preview.2","1.0.0-preview.3","1.0.0-preview.4","1.0.0-preview.5","1.0.0-preview.6","1.0.0-preview.7","1.0.1","1.0.2","1.1.0","1.1.1","1.1.2","1.2.0","1.3.0","1.4.0","1.5.0","1.5.1","1.6.0-beta.1"]}],"products":[{"vendor":"microsoft","product":"azure sdk"},{"vendor":"microsoft","product":"azure sdk for java"},{"vendor":"microsoft","product":"azure_sdk_for_java"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-16971","tags":["vendor-advisory","patch","web"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16971","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-16971","tags":["advisory"]},{"url":"https://azure.github.io/azure-sdk/releases/2020-10/index.html","tags":["web"]},{"url":"https://azure.github.io/azure-sdk/releases/2020-10/java.html","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8q69-pw39-hpqh"}],"sources":{"cve":[{"id":"CVE-2020-16971","title":"Azure SDK for Java Security Feature Bypass Vulnerability","description":"Azure SDK for Java Security Feature Bypass Vulnerability","status":"published","published":"2020-12-09T23:36:37Z","modified":"2026-06-09T18:08:16.883Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:35:59.116379Z"}],"euvd":[{"id":"EUVD-2022-3213","description":"Azure SDK for Java Security Feature Bypass Vulnerability","status":"published","published":"2020-12-09T23:36:37Z","modified":"2026-06-09T18:08:16Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-02T18:20:47.241018Z"}],"ghsa":[{"id":"GHSA-8q69-pw39-hpqh","title":"Azure SDK for Java Security Feature Bypass Vulnerability","description":"Azure SDK for Java Security Feature Bypass Vulnerability","status":"published","published":"2022-05-24T17:35:51Z","modified":"2024-10-17T17:16:53Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T14:38:11.479492Z"}],"nvd":[{"id":"CVE-2020-16971","description":"Azure SDK for Java Security Feature Bypass Vulnerability","status":"published","published":"2020-12-10T00:15:13.667Z","modified":"2026-06-17T02:58:23.127Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:27.10541Z"}],"osv":[{"id":"GHSA-8q69-pw39-hpqh","title":"Azure SDK for Java Security Feature Bypass Vulnerability","description":"Azure SDK for Java Security Feature Bypass Vulnerability","status":"published","published":"2022-05-24T17:35:51Z","modified":"2026-09-10T03:49:31.906526701Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:46:42.78452Z"}]}}