GHSA-G627-R579-RW35 Apache Pulsar: Improper Authorization For Topic-Level Policy Management

🗓️ 12 Mar 2024 21:30:59Reported by GoogleType

osv🔗 osv.dev👁 6 Views

Authenticated users with only produce or consume rights can modify topic policies; upgrade to patched Apache Pulsar versions.

Reporter	Title	Published	Views	Family All 20
IBM Security Bulletins	Security Bulletin: Due to use of Apache Pulsar, IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library is vulnerable to a security restrictions bypass.	30 Jul 202401:34	–	ibm
BDU FSTEC	The vulnerability of the cloud-based messaging and streaming transmission platform Apache Pulsar lies in its authentication procedures’ deficiencies, which allow attackers to alter arbitrary storage settings, TTL values, and download configurations.	6 Apr 202400:00	–	bdu_fstec
Circl	CVE-2024-28098	12 Mar 202420:26	–	circl
CNNVD	Apache Pulsar 安全漏洞	12 Mar 202400:00	–	cnnvd
CNVD	Unspecified Vulnerability in Apache Pulsar (CNVD-2024-26184)	14 Mar 202400:00	–	cnvd
CVE	CVE-2024-28098	12 Mar 202418:15	–	cve
Cvelist	CVE-2024-28098 Apache Pulsar: Improper Authorization For Topic-Level Policy Management	12 Mar 202418:15	–	cvelist
EUVD	EUVD-2024-0927	3 Oct 202520:07	–	euvd
Github Security Blog	Apache Pulsar: Improper Authorization For Topic-Level Policy Management	12 Mar 202421:30	–	github
NVD	CVE-2024-28098	12 Mar 202419:15	–	nvd

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-28098
github	www.github.com/apache/pulsar
lists	www.lists.apache.org/thread/3m6923y3wxpdcs9346sjvt8ql9swqc2z
pulsar	www.pulsar.apache.org/security/CVE-2024-28098
openwall	www.openwall.com/lists/oss-security/2024/03/12/12

13 Feb 2025 19:13Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.4

EPSS0.01701