Improper Authorization in Aedes MQTT Broker by Node.js
CVE-2018-3778

5.3MEDIUM

Key Information:

Vendor

Hackerone

Status
Aedes
Vendor
CVE Published:
8 August 2018

What is CVE-2018-3778?

Aedes MQTT broker versions prior to 0.35.0 exhibit an improper authorization vulnerability that allows unauthorized clients to publish a Last Will and Testament (LWT) message to a channel. This can lead to unintended access and message delivery scenarios, compromising the integrity and confidentiality of channel communications. It is crucial for users of affected versions to upgrade to the latest to mitigate potential exploitation.

Affected Version(s)

aedes >=0.35.1

References

https://github.com/nodejs/security-wg/blob/master/vuln/np...
x_refsource_MISC
https://github.com/mcollina/aedes/issues/212
x_refsource_MISC
https://github.com/mcollina/aedes/issues/211
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.