CVE-2024-28098

moderate-risk
Published 2024-03-12

The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTL, and offloading settings. These management operations should be restricted to users with the tenant admin role or super user role. This issue affects Apache Pulsar versions from 2.7.1 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. 2.10 Apache Pulsar users should upgrade to at least 2.10.6. 2.11 Apache Pulsar users should upgrade to at least 2.11.4. 3.0 Apache Pulsar users should upgrade to at least 3.0.3. 3.1 Apache Pulsar users should upgrade to at least 3.1.3. 3.2 Apache Pulsar users should upgrade to at least 3.2.1. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

Do I need to act?

-
0.23% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.4/10 Medium
NETWORK / LOW complexity

Affected Products (2)

Affected Vendors

Apache

References (6)

Mailing List http://www.openwall.com/lists/oss-security/2024/03/12/12
Vendor Advisory https://lists.apache.org/thread/3m6923y3wxpdcs9346sjvt8ql9swqc2z
Vendor Advisory https://pulsar.apache.org/security/CVE-2024-28098/
Mailing List http://www.openwall.com/lists/oss-security/2024/03/12/12
Vendor Advisory https://lists.apache.org/thread/3m6923y3wxpdcs9346sjvt8ql9swqc2z
Vendor Advisory https://pulsar.apache.org/security/CVE-2024-28098/
32
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 1/34 · Minimal
Exposure 7/34 · Low