The Eclipse Foundation Eclipse Mosquitto
En bref
- Source
- NVD
- EPSS
- EPSS 0.80 % · centile 57 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- eclipse
- Statut NVD
- Modified
Description
In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that topic revoked, the retained message will still be published to clients that subscribe to that topic in the future. In some applications this may result in clients being able cause effects that would otherwise not be allowed.
Faiblesses (CWE)
- CWE-284 — Contrôle d'accès incorrect
- CWE-732 — Attribution de permissions incorrecte sur une ressource critique
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.0 | AV:N/AC:L/Au:S/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2018-4506
- GCVE · GCVE-0-2018-12546
Configurations affectées (CPE NVD)
cpe:2.3:a:eclipse:mosquitto:*:*:*:*:*:*:*:*≥ 1.0 ≤ 1.5.5
Produits affectés
| Produit | Versions |
|---|---|
| The Eclipse Foundation · Eclipse Mosquitto | affected 1.0 < unspecified ; affected unspecified ≤ 1.5.5 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |