CVE-2023-31007

published 2023-07-12

CVE-2023-31007: Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication…

Priority P3 40 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C N I H A N

Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication data expires if the client connected through the Pulsar Proxy when the broker is configured with authenticateOriginalAuthData=false or if a client connects directly to a broker with a specially crafted connect command when the broker is configured with authenticateOriginalAuthData=false.

This issue affects Apache Pulsar: through 2.9.4, from 2.10.0 through 2.10.3, 2.11.0.

2.9 Pulsar Broker users should upgrade to at least 2.9.5.
2.10 Pulsar Broker users should upgrade to at least 2.10.4.
2.11 Pulsar Broker users should upgrade to at least 2.11.1.
3.0 Pulsar Broker users are unaffected.
Any users running the Pulsar Broker for 2.8.* and earlier should upgrade to one of the above patched versions.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
apache	pulsar	< 2.9.5	2.9.5
apache	pulsar	—	—
apache	pulsar	2.10.0 – 2.10.3	—
apache_software_foundation	apache_pulsar	< 2.9.5	2.9.5
apache_software_foundation	apache_pulsar	—	—
apache_software_foundation	apache_pulsar	2.10.0 – 2.10.3	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-287