CVE-2017-7650

MEDIUM

Mosquitto < 1.4.12 - Improper Authentication via Username/Client ID Bypass

Title source: llm

Description

In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access control plugins for Mosquitto.

References (4)

Core 4

Core References

Patch, Vendor Advisory x_refsource_confirm

http://mosquitto.org/2017/05/security-advisory-cve-2017-7650/

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/98741

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2017/dsa-3865

Exploit, Third Party Advisory x_refsource_confirm

https://bugs.eclipse.org/bugs/show_bug.cgi?id=516765

Scores

CVSS v3 6.5

EPSS 0.0060

EPSS Percentile 69.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-287

Status published

Products (3)

debian/debian_linux 8.0

eclipse/mosquitto < 1.4.12

Eclipse Foundation/Mosquitto 0.15 to 1.4.11 inclusive

Published Sep 11, 2017

Tracked Since Feb 18, 2026