CVE-2022-24721

The CVE-2022-24721 issue affects CometD’s Oort/Seti channels. In all versions prior to 5.0.11, 6.0.6, and 7.0.6, internal authorization is improper, allowing remote users to subscribe to or publish on these channels. Subscribing can enable viewing cluster-internal traffic; publishing can allow cr...

CVE-2022-24721 Incorrect Authorization in org.cometd.oort

CometD is a scalable comet implementation for web messaging. In any version prior to 5.0.11, 6.0.6, and 7.0.6, internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels. By subscribing to those channels, a remote user may b...

CometD security vulnerabilities

CometD is an extensible WebSocket and HTTP-based event and message routing bus for the CometD community. A security vulnerability in CometD in any version prior to 5.0.11, 6.0.6, and 7.0.6 stems from the fact that internal use of the Oort and Seti channels is not properly authorized, so any remot...

PT-2022-16829

Name of the Vulnerable Software and Affected Versions CometD versions prior to 5.0.11, 6.0.6, and 7.0.6 Description CometD is a scalable comet implementation for web messaging. In versions prior to 5.0.11, 6.0.6, and 7.0.6, internal usage of Oort and Seti channels is improperly authorized, allowi...

CVE-2022-24721: Incorrect Authorization

CometD is a scalable comet implementation for web messaging. In any version prior to 5.0.11, 6.0.6, and 7.0.6, internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels. By subscribing to those channels, a remote user may b...

io.brooklyn.example:brooklyn-example-global-web-fabric (0.4.0), io.brooklyn.example:brooklyn-example-hadoop-and-whirr (0.4.0) +59 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (7.4.4.v20110707)

org.eclipse.jetty:jetty-server MAVEN version 7.4.4.v20110707 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - io.brooklyn.example:brooklyn-example-global-web-fabric 0.4.0 -...

org.cometd:cometd-demo (2.1.0), org.eclipse.jetty.aggregate:jetty-all (7.3.0.v20110203) +7 more potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (7.3.0.v20110203)

org.eclipse.jetty:jetty-servlets MAVEN version 7.3.0.v20110203 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - org.cometd:cometd-demo 2.1.0 - org.eclipse.jetty.aggregate:jetty-all 7.3.0.v20110203 ...

org.apache.camel:camel-example-cxf (2.8.0), org.apache.camel:camel-jetty (2.8.0) +8 more potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (7.4.2.v20110526)

org.eclipse.jetty:jetty-servlets MAVEN version 7.4.2.v20110526 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - org.apache.camel:camel-example-cxf 2.8.0 - org.apache.camel:camel-jetty 2.8.0 -...

org.apache.camel:camel-example-cxf (>=2.9.0-rc1, <=2.9.0), org.apache.camel:camel-jetty (>=2.9.0-rc1, <=2.9.0) +10 more potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (7.5.3.v20111011)

org.eclipse.jetty:jetty-servlets MAVEN version 7.5.3.v20111011 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - org.apache.camel:camel-example-cxf =2.9.0-rc1, =2.9.0-rc1, =1.1.5, =2.4.0.rc1 -...

org.cometd.java:cometd-java-examples (>=2.9.0, <=2.9.1), org.cometd.tutorials:cometd-tutorials-skeleton (>=2.9.0, <=2.9.1) +9 more potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (7.6.15.v20140411)

org.eclipse.jetty:jetty-servlets MAVEN version 7.6.15.v20140411 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - org.cometd.java:cometd-java-examples =2.9.0, =2.9.0, =2.9.0, =2.9.1 -...

org.apache.camel:camel-example-cxf (2.3.0), org.apache.camel:camel-jetty (2.3.0) +6 more potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (7.0.1.v20091125)

org.eclipse.jetty:jetty-servlets MAVEN version 7.0.1.v20091125 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - org.apache.camel:camel-example-cxf 2.3.0 - org.apache.camel:camel-jetty 2.3.0 -...

org.cometd:cometd-demo (>=1.1.0, <=2.0.beta0), org.eclipse.jetty.aggregate:jetty-all (7.0.2.v20100331) +4 more potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (7.0.2.v20100331)

org.eclipse.jetty:jetty-servlets MAVEN version 7.0.2.v20100331 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - org.cometd:cometd-demo =1.1.0, =2.0.beta0 - org.eclipse.jetty.aggregate:jetty-all...

org.cometd:cometd-demo (2.0.beta1), org.eclipse.jetty.aggregate:jetty-all (7.1.3.v20100526) +3 more potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (7.1.3.v20100526)

org.eclipse.jetty:jetty-servlets MAVEN version 7.1.3.v20100526 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - org.cometd:cometd-demo 2.0.beta1 - org.eclipse.jetty.aggregate:jetty-all...

org.cometd:cometd-demo (>=1.1.2, <=2.0.0), org.eclipse.jetty.aggregate:jetty-all (7.1.5.v20100705) +3 more potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (7.1.5.v20100705)

org.eclipse.jetty:jetty-servlets MAVEN version 7.1.5.v20100705 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - org.cometd:cometd-demo =1.1.2, =2.0.0 - org.eclipse.jetty.aggregate:jetty-all...

org.cometd.java:cometd-java-examples (2.4.0.beta2), org.cometd:cometd-demo (>=2.4.0.beta1, <=2.4.0.beta2) +8 more potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (7.5.1.v20110908)

org.eclipse.jetty:jetty-servlets MAVEN version 7.5.1.v20110908 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - org.cometd.java:cometd-java-examples 2.4.0.beta2 - org.cometd:cometd-demo =2.4.0.beta...

com.cisco.oss.foundation:http-server-jetty-8 (>=0.0.0-6, <=1.0.2-2), net.osgiliath.framework:net.osgiliath.features.karaf-features-camel (>=0.1.2, <=0.1.5) +14 more potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (8.1.15.v20140411)

org.eclipse.jetty:jetty-servlets MAVEN version 8.1.15.v20140411 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - com.cisco.oss.foundation:http-server-jetty-8 =0.0.0-6, =0.1.2, =2.14.0, =2.14.0,...

org.cometd:cometd-demo (>=2.2.0.rc0, <=2.2.0), org.eclipse.jetty.aggregate:jetty-all (7.4.0.v20110414) +5 more potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (7.4.0.v20110414)

org.eclipse.jetty:jetty-servlets MAVEN version 7.4.0.v20110414 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - org.cometd:cometd-demo =2.2.0.rc0, =2.2.0 - org.eclipse.jetty.aggregate:jetty-all...

org.apache.camel:camel-amqp (2.0-m3), org.apache.camel:camel-atom (2.0-m3) +67 more potentially affected by CVE-2020-11971 via org.apache.camel:camel-core (2.0-m3)

org.apache.camel:camel-core MAVEN version 2.0-m3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - org.apache.camel:camel-amqp 2.0-m3 - org.apache.camel:camel-atom 2.0-m3 - org.apache.camel:camel-bam...

io.brooklyn.example:brooklyn-example-global-web-fabric (0.4.0), io.brooklyn.example:brooklyn-example-hadoop-and-whirr (0.4.0) +59 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.4.4.v20110707)

org.eclipse.jetty:jetty-server MAVEN version 7.4.4.v20110707 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - io.brooklyn.example:brooklyn-example-global-web-fabric 0.4.0 -...

org.apache.camel:camel-cometd (>=2.9.0-rc1, <=2.9.0), org.apache.camel:camel-example-cxf (>=2.9.0-rc1, <=2.9.0) +109 more potentially affected by CVE-2017-7658 via org.eclipse.jetty:jetty-server (7.5.3.v20111011)

org.eclipse.jetty:jetty-server MAVEN version 7.5.3.v20111011 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.apache.camel:camel-cometd =2.9.0-rc1, =2.9.0-rc1, =2.9.0-rc1, =2.9.0-rc1, =2.9.0-rc1,...