CVE-2016-2141

JGroups: Authorization bypass

Published Jun 30, 2016 CVSS 3.1 · 9.8 Critical EPSS 4.7% KEV · Not listed
Description
It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-5146 It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.
Github GHSA Github GHSA GHSA-rc7h-x6cq-988q Improper Input Validation in JGroups
History

No history.