CVE-2023-37544

published 2023-12-20

CVE-2023-37544: Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication. This…

Priority P3 44 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication.

This issue affects Apache Pulsar WebSocket Proxy: from 2.8.0 through 2.8.*, from 2.9.0 through 2.9.*, from 2.10.0 through 2.10.4, from 2.11.0 through 2.11.1, 3.0.0.

The known risks include a denial of service due to the WebSocket Proxy accepting any connections, and excessive data transfer due to misuse of the WebSocket ping/pong feature.

2.10 Pulsar WebSocket Proxy users should upgrade to at least 2.10.5.
2.11 Pulsar WebSocket Proxy users should upgrade to at least 2.11.2.
3.0 Pulsar WebSocket Proxy users should upgrade to at least 3.0.1.
3.1 Pulsar WebSocket Proxy users are unaffected.
Any users running the Pulsar WebSocket Proxy for 2.8, 2.9, and earlier should upgrade to one of the above patched versions.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
apache	pulsar	< 2.10.5	2.10.5
apache	pulsar	—	—
apache	pulsar	>= 2.11.0 < 2.11.2	2.11.2
apache_software_foundation	apache_pulsar_websocket_proxy	—	—
apache_software_foundation	apache_pulsar_websocket_proxy	2.10.0 – 2.10.4	—
apache_software_foundation	apache_pulsar_websocket_proxy	2.11.0 – 2.11.1	—
apache_software_foundation	apache_pulsar_websocket_proxy	2.8.0 – 2.8.*	—
apache_software_foundation	apache_pulsar_websocket_proxy	2.9.0 – 2.9.*	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-287