Improper Authentication

2024-03-1310:33:02

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

apache pulsar proxy

improper authentication

authorization checks

/proxy-stats endpoint

unauthorized access

connection statistics

logging levels

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

AI Score

6.6

Confidence

High

EPSS

Percentile

15.7%

JSON

Apache Pulsar Proxy is vulnerable to Improper Authentication. The vulnerability is caused due to missing authorization checks in the /proxy-stats endpoint. This can lead to unauthorized access this sensitive endpoints, allowing attackers to view detailed connection statistics and potentially manipulate logging levels without proper authentication.