CVE-2023-32081: Vert.x STOMP server process client frames that would not send initially a connect frame
Vert.x STOMP is a vert.x implementation of the STOMP specification that provides a STOMP server and client. From versions 3.1.0 until 3.9.16 and 4.0.0 until 4.4.2, a Vert.x STOMP server processes client STOMP frames without checking that the client send an initial CONNECT frame replied with a successful CONNECTED frame. The client can subscribe to a destination or publish message without prior authentication. Any Vert.x STOMP server configured with an authentication handler is impacted. The issue is patched in Vert.x 3.9.16 and 4.4.2. There are no trivial workarounds.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-32081?
CVE-2023-32081 is a vulnerability in the Vert.x STOMP server that allows clients to send STOMP frames without an initial CONNECT frame, leading to potential security risks.
How severe is CVE-2023-32081?
CVE-2023-32081 has a severity rating of 6.5, which is considered medium.
Which versions of Eclipse Vert.x Stomp are affected by CVE-2023-32081?
Versions 3.1.0 to 3.9.16 and 4.0.0 to 4.4.2 of Eclipse Vert.x Stomp are affected by CVE-2023-32081.
How can I fix CVE-2023-32081?
To fix CVE-2023-32081, update your Eclipse Vert.x Stomp server to a version that is not affected by this vulnerability.
Where can I find more information about CVE-2023-32081?
More information about CVE-2023-32081 can be found in the references section of the vulnerability report.