-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing ACL enforcement when creating federation links. The JIRA ticket QPID-4631 explicitly describes the brokerCreateLink function's lack of ACL checks in vulnerable versions, which aligns with Red Hat's patch adding ACL verification. The ConnectionHandler's Open frame processing is implicated through Bugzilla analysis showing improper privilege escalation via federation_tag. Both functions would appear in stack traces during exploitation: one during connection establishment and another during link creation.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.qpid:qpid-client | maven | < 0.20 | 0.20 |
Ongoing coverage of React2Shell