Improper Authorization

2022-03-1607:26:44

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cometd

oort

seti

unauthorized access

cluster traffic

data manipulation

EPSS

0.001

Percentile

46.3%

JSON

org.cometd.java:cometd-java-oort is vulnerable to improper authorization. Remote attackers are able to subscribe and publish to Oort and Seti channels due to improper authorization, allowing interception of internal cluster traffic. As a result the remote attackers are able to create/modify/delete other user’s data and modify the cluster structure.