Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2015-0223: Apache Qpid lets attackers bypass access controls

CVE-2015-0223 · published 11 years ago

Summary

Versions of Apache Qpid up to 0.30 may let a remote user get past the normal permission checks on the qpidd service. This could allow someone to access or manipulate messaging data they shouldn’t see. Update to a newer version of Apache Qpid or apply the vendor’s recommended configuration changes to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
apache	qpid	<= 0.30 `cpe:2.3:a:apache:qpid::::::::`

Original advisory text

Unspecified vulnerability in Apache Qpid 0.30 and earlier allows remote attackers to bypass access restrictions on qpidd via unknown vectors, related to 0-10 connection handling.

References

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

5.0 Medium

Exploitation

7% chance of attack within 30 days

Type

CWE-264Permissions, Privileges, and Access Controls

Timeline

Published2 Feb 2015

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2015-0223 · NVD

Track software like this

Free during beta