The vulnerability of the cloud-based messaging and streaming transmission platform Apache Pulsar lies in its authentication procedures’ deficiencies, which allow attackers to alter arbitrary storage settings, TTL values, and download configurations.

Apache Pulsar has authentication flaws that allow attackers to modify storage settings, time to live values, and download configurations.

Reporter	Title	Published	Views	Family All 20
IBM Security Bulletins	Security Bulletin: Due to use of Apache Pulsar, IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library is vulnerable to a security restrictions bypass.	30 Jul 202401:34	–	ibm
Circl	CVE-2024-28098	12 Mar 202420:26	–	circl
CNNVD	Apache Pulsar 安全漏洞	12 Mar 202400:00	–	cnnvd
CNVD	Unspecified Vulnerability in Apache Pulsar (CNVD-2024-26184)	14 Mar 202400:00	–	cnvd
CVE	CVE-2024-28098	12 Mar 202418:15	–	cve
Cvelist	CVE-2024-28098 Apache Pulsar: Improper Authorization For Topic-Level Policy Management	12 Mar 202418:15	–	cvelist
EUVD	EUVD-2024-0927	3 Oct 202520:07	–	euvd
Github Security Blog	Apache Pulsar: Improper Authorization For Topic-Level Policy Management	12 Mar 202421:30	–	github
NVD	CVE-2024-28098	12 Mar 202419:15	–	nvd
OSV	CVE-2024-28098	12 Mar 202419:15	–	osv

Vulners

Node

apache pulsarRange2.11.0–2.11.4

apache pulsarRange3.0.0–3.0.3

apache pulsarRange3.1.0–3.1.3

apache pulsarRange3.2.0–3.2.1

apache pulsarRange2.7.1–2.10.6

Source	Link
lists	www.lists.apache.org/thread/3m6923y3wxpdcs9346sjvt8ql9swqc2z
pulsar	www.pulsar.apache.org/security/CVE-2024-28098/
web	www.web.nvd.nist.gov/view/vuln/detail

06 Apr 2024 00:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 25.5

CVSS 36.4

EPSS0.01701