CVE-2016-8741 Exposure of Sensitive Information to an Unauthorized Actor in Apache Qpid Broker for Java
Remote attackers can enumerate valid user accounts in Apache Qpid Broker-J when SCRAM authentication is enabled due to premature SASL negotiation termination.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-8741?
CVE-2016-8741 is a high-severity vulnerability in Apache Qpid Broker-J, published on 15 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these AuthenticationProviders in Apache Qpid Broker for Java 6.0.x before 6.0.6 and 6.1.x before 6.1.1 prematurely terminate the SCRAM SASL negotiation if the provided user name does not exist thus allowing remote attacker to determine the existence of user accounts. The Vulnerability does not apply to AuthenticationProviders other than SCRAM-SHA-1 and SCRAM-SHA-256.
Weakness: CWE-200
Which versions are affected by CVE-2016-8741?
4 open source packages ship an affected version, including org.apache.qpid:qpid-broker. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.qpid:qpid-broker Maven | From 6.0.0 | 6.0.6 |
org.apache.qpid:qpid-broker Maven | From 6.0.0 | 6.0.6 |
org.apache.qpid:qpid-broker Maven | From 6.1.0 | 6.1.1 |
org.apache.qpid:qpid-broker Maven | From 6.1.0 | 6.1.1 |
Products include Apache Qpid Broker-J.
How do I fix CVE-2016-8741?
Upgrade org.apache.qpid:qpid-broker to a fixed version for your release line: 6.0.6 or 6.1.1.
Is CVE-2016-8741 being exploited?
There is no known exploitation of CVE-2016-8741 in the wild and no public exploit code.
Other vulnerabilities in Apache Qpid Broker-J
- CVE-2026-92609 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication
- CVE-2017-15702 Apache Qpid Broker vulnerable to authentication port spoofing
- CVE-2016-4432 AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication
- CVE-2026-92550 Denial of service in Apache Qpid Broker-J
- CVE-2026-92560 Denial of service in Apache Qpid Broker-J
Sources
Also known as GHSA-8vvh-crqv-jm64.