CVE-2018-12550: When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only comments or blank lines…

PriorityP341high8.1CVSS 3.0

AVNACHPRNUINSUCHIHAH

EPSS

1.35%

68.1th percentile

When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only comments or blank lines, then Mosquitto will treat this as though no ACL file has been defined and use a default allow policy. The new behaviour is to have an empty ACL file mean that all access is denied, which is not a useful configuration but is not unexpected.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
debian	mosquitto	< mosquitto 1.5.6-1 (bookworm)	mosquitto 1.5.6-1 (bookworm)
eclipse	mosquitto	>= 0 < 1.5.6-1	1.5.6-1
eclipse	mosquitto	>= 0 < 1.5.6-1	1.5.6-1
eclipse	mosquitto	>= 0 < 1.5.6-1	1.5.6-1
eclipse	mosquitto	>= 0 < 1.5.6-1	1.5.6-1
eclipse	mosquitto	1.0 – 1.5.5	—
the_eclipse_foundation	eclipse_mosquitto	>= 1.0 < unspecified	unspecified
the_eclipse_foundation	eclipse_mosquitto	unspecified – 1.5.5	—

CVSS provenance

nvdv3.08.1HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

osv8.1HIGH

vendor_debian8.1HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.