Vulnerability · Published Mar 15, 2022 · Assigned by GitHub_M
CVE-2022-24721Incorrect Authorization in org.cometd.oort
High 8.1
In plain English
A high-severity incorrect authorization in cometd from cometd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
CometD is a scalable comet implementation for web messaging. In any version prior to 5.0.11, 6.0.6, and 7.0.6, internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels. By subscribing to those channels, a remote user may be able to watch cluster-internal traffic that contains other users' (possibly sensitive) data. By publishing to those channels, a remote user may be able to create/modify/delete other user's data and modify the cluster structure. A fix is available in versions 5.0.11, 6.0.6, and 7.0.6. As a workaround, install a custom `SecurityPolicy` that forbids subscription and publishing to remote, non-Oort, sessions on Oort and Seti channels.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.cometd.java:cometd-java-oort | 5.0.11 | GHSA-rjmq-6v55-4rjv |
| Maven | org.cometd.java:cometd-java-oort | 6.0.6 | GHSA-rjmq-6v55-4rjv |
| Maven | org.cometd.java:cometd-java-oort | 7.0.6 | GHSA-rjmq-6v55-4rjv |
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- https://github.com/cometd/cometd/security/advisories/GHSA-rjmq-6v55-4rjv x_refsource_CONFIRM
- https://github.com/cometd/cometd/issues/1146 x_refsource_MISC