CVE-2016-9877
CriticalSummary
An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6, as well as RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7, regarding MQTT connection authentication. Authentication using a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request.
Risk Assessment
Organizations may be exposed to unauthorized access to the system, potentially leading to data breaches or other serious security incidents.
Recommendation
It is recommended to update Pivotal RabbitMQ to the latest version to mitigate this vulnerability and to implement additional security measures, such as enforcing password input during authentication.
Original NVD description (English source)
An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.