Log in Start free

Vulnerability · Published Sep 23, 2022 · Assigned by apache

CVE-2022-24280Apache Pulsar Proxy target broker address isn't validated

Medium 6.5

In plain English

A medium-severity improper input validation in Apache Pulsar from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.5%top 26.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection attempts that originate from the Pulsar Proxy's IP address. When the Apache Pulsar Proxy component is used, it is possible to attempt to open TCP/IP connections to any IP address and port that the Pulsar Proxy can connect to. An attacker could use this as a way for DoS attacks that originate from the Pulsar Proxy's IP address. It hasn’t been detected that the Pulsar Proxy authentication can be bypassed. The attacker will have to have a valid token to a properly secured Pulsar Proxy. This issue affects Apache Pulsar Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.2; 2.9.0 to 2.9.1; 2.6.4 and earlier.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.apache.pulsar:pulsar2.7.5GHSA-3mg9-m3f6-v7fq
Mavenorg.apache.pulsar:pulsar2.8.3GHSA-3mg9-m3f6-v7fq
Mavenorg.apache.pulsar:pulsar2.9.2GHSA-3mg9-m3f6-v7fq

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Pulsar 2.7 – through 2.7.42.8 – through 2.8.22.9 – through 2.9.12.6 and earlier – through 2.6.4

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References