CVE-2023-37579 Apache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source Credentials

🗓️ 12 Jul 2023 09:05:24Reported by apacheType

Apache Pulsar Function Worker Vulnerabilit

Reporter	Title	Published	Views	Family All 12
IBM Security Bulletins	Security Bulletin: Due to use of Apache Pulsar, IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library is vulnerable to a security restrictions bypass.	28 Sep 202303:14	–	ibm
BDU FSTEC	The vulnerability of the cloud-based messaging and streaming transmission platform Apache Pulsar, related to authentication deficiencies, allows attackers to gain access to the configuration of the cloud-based platform.	3 Aug 202300:00	–	bdu_fstec
Circl	CVE-2023-37579	12 Jul 202314:45	–	circl
CNNVD	Apache Pulsar 安全漏洞	12 Jul 202300:00	–	cnnvd
CVE	CVE-2023-37579	12 Jul 202309:05	–	cve
Cvelist	CVE-2023-37579 Apache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source Credentials	12 Jul 202309:05	–	cvelist
EUVD	EUVD-2023-1984	3 Oct 202520:07	–	euvd
Github Security Blog	Apache Pulsar Function Worker Incorrect Authorization vulnerability	12 Jul 202312:31	–	github
NVD	CVE-2023-37579	12 Jul 202310:15	–	nvd
OSV	GHSA-74MC-G2XV-PCH2 Apache Pulsar Function Worker Incorrect Authorization vulnerability	12 Jul 202312:31	–	osv

[
  {
    "cpes": [
      "cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*"
    ],
    "vendor": "apache",
    "product": "pulsar",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.10.4",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "2.11.0"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
lists	www.lists.apache.org/thread/0dmn3cb5n2p08o3cpj3ycfhzfqs2ppwz

12 Jul 2023 09:05Current

8.1High risk

Vulners AI Score8.1

CVSS 3.18.2

EPSS0.00819

SSVC

CWE-863