CVE-2022-24280: Apache Pulsar Proxy target broker address isn't validated
First published: Fri Sep 23 2022(Updated: )
Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection attempts that originate from the Pulsar Proxy's IP address. When the Apache Pulsar Proxy component is used, it is possible to attempt to open TCP/IP connections to any IP address and port that the Pulsar Proxy can connect to. An attacker could use this as a way for DoS attacks that originate from the Pulsar Proxy's IP address. It hasn’t been detected that the Pulsar Proxy authentication can be bypassed. The attacker will have to have a valid token to a properly secured Pulsar Proxy. This issue affects Apache Pulsar Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.2; 2.9.0 to 2.9.1; 2.6.4 and earlier.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Pulsar | <=2.6.4 | |
| Apache Pulsar | >=2.7.0<2.7.5 | |
| Apache Pulsar | >=2.8.0<2.8.3 | |
| Apache Pulsar | >=2.9.0<2.9.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2022-24280?
CVE-2022-24280 is an Improper Input Validation vulnerability in the Proxy component of Apache Pulsar.
What is the severity of CVE-2022-24280?
CVE-2022-24280 has a severity score of 6.5, which is considered medium.
How does CVE-2022-24280 impact Apache Pulsar?
CVE-2022-24280 allows an attacker to make TCP/IP connection attempts that originate from the Pulsar Proxy's IP address, potentially leading to unauthorized access.
Which versions of Apache Pulsar are affected by CVE-2022-24280?
CVE-2022-24280 affects Apache Pulsar versions 2.3 up to and including 2.6.4, 2.7.0 up to but excluding 2.7.5, 2.8.0 up to but excluding 2.8.3, and 2.9.0 up to but excluding 2.9.2.
Is there a fix available for CVE-2022-24280?
Yes, Apache Pulsar has released patches to address the CVE-2022-24280 vulnerability. It is recommended to update to the latest version of Apache Pulsar.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- vendor/apache
- canonical/apache pulsar
- version/apache pulsar/2.6.4
- version/apache pulsar/2.7.0
- version/apache pulsar/2.8.0
- version/apache pulsar/2.9.0