CVE-2017-7650

In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'

published September 11, 2017

CVSS
—
EPSS
2%
Percentile
84.3
In the wild
Unconfirmed
What it is

In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access control plugins for Mosquitto.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02472 · 84.3th percentile
Published
2017-09-11T16:00Z
EPSS history
Timeline
  • 11 SEP 16:00Z
    In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'
    cvelistv5