-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from the use of NullAuthenticator for cluster 'catch-up' shadow connections, as confirmed by the CVE description and the fix in Apache's SVN commit r1352992. The commit modified SaslAuthenticator and cluster connection logic to enforce authentication. The functions responsible for initializing authentication for these connections (e.g., SaslAuthenticator::create) were likely the points where NullAuthenticator was improperly applied. The cluster's Connection class would have bypassed standard authentication flows for shadow connections, leading to the bypass. The high confidence comes from direct references in the commit message and JIRA ticket QPID-3849 linking the issue to missing authentication in shadow connections.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.qpid:qpid-parent | maven | < 0.17 | 0.17 |
Ongoing coverage of React2Shell