CVE-2017-15702 Apache Qpid Broker vulnerable to authentication port spoofing
Remote attackers can bypass firewall protections by forcing the broker to use weaker authentication providers configured on other ports.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-15702?
CVE-2017-15702 is a critical authentication bypass vulnerability in Apache Qpid Broker-J, published on 1 Dec 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on different ports one of which is an HTTP port, then the broker can be tricked by a remote unauthenticated attacker connecting to the HTTP port into using an authentication provider that was configured on a different port. The attacker still needs valid credentials with the authentication provider on the spoofed port. This becomes an issue when the spoofed port has weaker authentication protection (e.g., anonymous access, default accounts) and is normally protected by firewall rules or similar which can be circumvented by this vulnerability. AMQP ports are not affected. Versions 6.0.0 and newer are not affected.
Which versions are affected by CVE-2017-15702?
2 open source packages ship an affected version, including org.apache.qpid:qpid-broker. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.qpid:qpid-broker Maven | From 0.18 | 6.0.0 |
org.apache.qpid:qpid-broker Maven | From 0.18 | 6.0.0 |
Products include Apache Qpid Broker-J.
How do I fix CVE-2017-15702?
Upgrade org.apache.qpid:qpid-broker to 6.0.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-15702 being exploited?
There is no known exploitation of CVE-2017-15702 in the wild and no public exploit code.
Other vulnerabilities in Apache Qpid Broker-J
- CVE-2026-92609 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication
- CVE-2016-4432 AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication
- CVE-2026-92550 Denial of service in Apache Qpid Broker-J
- CVE-2026-92560 Denial of service in Apache Qpid Broker-J
- CVE-2026-92564 Denial of service in Apache Qpid Broker-J
Sources
Also known as GHSA-269m-695x-j34p.