apache Vulnerabilities and Affected Products
Vulnerabilities associated with pulsar.
Products
Clear product- HTTP Server21 vulnerabilities
- OFBiz21 vulnerabilities
- Struts18 vulnerabilities
- inlong17 vulnerabilities
- Tomcat16 vulnerabilities
- airflow15 vulnerabilities
- Solr10 vulnerabilities
- traffic_server8 vulnerabilities
- ActiveMQ7 vulnerabilities
- linkis7 vulnerabilities
- cloudstack6 vulnerabilities
- cxf6 vulnerabilities
- dolphinscheduler6 vulnerabilities
- hertzbeat6 vulnerabilities
- http_server6 vulnerabilities
- pulsar6 vulnerabilities
- streampark6 vulnerabilities
- zeppelin6 vulnerabilities
- Apache HTTP Server5 vulnerabilities
- Apache Tomcat5 vulnerabilities
- kafka5 vulnerabilities
- ambari4 vulnerabilities
- Apache OFBiz4 vulnerabilities
- Apache Tika4 vulnerabilities
- camel4 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-27317HIGH | Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File ModificationIn Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in the zip files, which aren't properly validated, contain special elements like "..", altering the directory path. This could allow an attacker to create or modify files outside of the designated extraction … CWE-22Mar 12, 2024 | CVSS8.4v3.1 | EPSS56.9% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-27135HIGH | Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code ExecutionImproper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, outside of the sandboxes designated for running user-provided functions. This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true". This issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. 2.10 Pulsar Funct… | CVSS8.5v3.1 | EPSS5.98% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-34321HIGH | Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics EndpointImproper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable endpoint exposes detailed statistics about live connections, along with the capability to modify the logging level of proxied connections without requiring proper authentication credentials. This issue affects Apache Pulsar versions from 2.6.0 to 2.10.5, from 2.11.0 to 2.11.2, from 3.0.0 to 3.0.1, and 3.1.0. The known risks include expos… CWE-306Mar 12, 2024 | CVSS8.2v3.1 | EPSS1.77% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-30428HIGH | Apache Pulsar Broker: Incorrect Authorization Validation for Rest ProducerIncorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP header to produce a message to any topic using the broker's admin role. This issue affects Apache Pulsar Brokers: from 2.9.0 through 2.9.5, from 2.10.0 before 2.10.4, 2.11.0. The vulnerability is exploitable when an attacker can connect directly to the Pulsar Broker. If an attacker is connecting through the Pulsar Proxy, there is no known way to e… CWE-863Jul 12, 2023 | CVSS8.2v3.1 | EPSS0.819% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-30429CRITICAL | Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar ProxyIncorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. When a client connects to the Pulsar Function Worker via the Pulsar Proxy where the Pulsar Proxy uses mTLS authentication to authenticate with the Pulsar Function Worker, the Pulsar Function Worker incorrectly performs authorization by using the Proxy's role for authorization instead of the client's role, which can lead to privilege escalation, especia… CWE-863Jul 12, 2023 | CVSS9.6v3.1 | EPSS1.04% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-37579HIGH | Apache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source CredentialsIncorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Function Worker. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. Any authenticated user can retrieve a source's configuration or a sink's configuration without authorization. Many sources and sinks contain credentials in the configuration, which could lead to leaked credentials. This vulnerability is mitigated by the fact that there is not a known way for an authenticated user to enumerate another te… CWE-863Jul 12, 2023 | CVSS8.2v3.1 | EPSS0.819% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |