CVE-2023-37544CWE-287

Apache Pulsar WebSocket Proxy: Improper Authentication for WebSocket Proxy Endpoint Allows DoS

High · published December 20, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
71.3
In the wild
Unconfirmed
What it is

Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication.

This issue affects Apache Pulsar WebSocket Proxy: from 2.8.0 through 2.8.*, from 2.9.0 through 2.9.*, from 2.10.0 through 2.10.4, from 2.11.0 through 2.11.1, 3.0.0.

The known risks include a denial of service due to the WebSocket Proxy accepting any connections, and excessive data transfer due to misuse of the WebSocket ping/pong feature.

2.10 Pulsar WebSocket Proxy users should upgrade to at least 2.10.5.

2.11 Pulsar WebSocket Proxy users should upgrade to at least 2.11.2.

3.0 Pulsar WebSocket Proxy users should upgrade to at least 3.0.1.

3.1 Pulsar WebSocket Proxy users are unaffected.

Any users running the Pulsar WebSocket Proxy for 2.8, 2.9, and earlier should upgrade to one of the above patched versions.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01351 · 71.3th percentile
Weakness
CWE-287 · Improper Authentication
Published
2023-12-20T08:34Z
EPSS history
Timeline
  • 20 DEC 08:34Z
    Apache Pulsar WebSocket Proxy: Improper Authentication for WebSocket Proxy Endpoint Allows DoS
    cvelistv5