org.apache.pulsar:pulsar-broker-auth-athenz (>=3.1.0 <=3.1.2), org.apache.pulsar:pulsar-broker-auth-sasl (>=3.1.0 <=3.1.2) +2 more potentially affected by CVE-2024-28098 via org.apache.pulsar:pulsar-broker (>=3.1.0 <=3.1.2)

🗓️ 12 Mar 2024 21:30:59Reported by Vulners OSVType

vulnersosv

vulnersosv🔗 osv.dev👁 7 Views

Pulsar broker versions 3.1.0 to 3.1.2 and related packages are affected by CVE-2024-28098.

Reporter	Title	Published	Views	Family All 20
IBM Security Bulletins	Security Bulletin: Due to use of Apache Pulsar, IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library is vulnerable to a security restrictions bypass.	30 Jul 202401:34	–	ibm
BDU FSTEC	The vulnerability of the cloud-based messaging and streaming transmission platform Apache Pulsar lies in its authentication procedures’ deficiencies, which allow attackers to alter arbitrary storage settings, TTL values, and download configurations.	6 Apr 202400:00	–	bdu_fstec
Circl	CVE-2024-28098	12 Mar 202420:26	–	circl
CNNVD	Apache Pulsar 安全漏洞	12 Mar 202400:00	–	cnnvd
CNVD	Unspecified Vulnerability in Apache Pulsar (CNVD-2024-26184)	14 Mar 202400:00	–	cnvd
CVE	CVE-2024-28098	12 Mar 202418:15	–	cve
Cvelist	CVE-2024-28098 Apache Pulsar: Improper Authorization For Topic-Level Policy Management	12 Mar 202418:15	–	cvelist
EUVD	EUVD-2024-0927	3 Oct 202520:07	–	euvd
Github Security Blog	Apache Pulsar: Improper Authorization For Topic-Level Policy Management	12 Mar 202421:30	–	github
NVD	CVE-2024-28098	12 Mar 202419:15	–	nvd

13 Feb 2025 19:13Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.15.4 - 6.4

EPSS0.01701

SSVC

pulsar broker vulnerable versions 3.1.0-3.1.2 cve 2024-28098 transitive dependencies related packages