PT-2023-23593 · Unknown · Vert.X Stomp

Navidmitchell · Publicado 2023-05-12 · Atualizado 2023-05-24 · CVE-2023-32081

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vert.x STOMP versions 3.1.0 through 3.9.16 Vert.x STOMP versions 4.0.0 through 4.4.2

Description The Vert.x STOMP server processes client STOMP frames without checking that the client sent an initial CONNECT frame replied with a successful CONNECTED frame. This allows a client to subscribe to a destination or publish a message without prior authentication. Any Vert.x STOMP server configured with an authentication handler is impacted.

Recommendations For versions 3.1.0 through 3.9.15, update to version 3.9.16. For versions 4.0.0 through 4.4.1, update to version 4.4.2.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2023-32081

GHSA-GVRQ-CG5R-7CHP

Produtos afetados

Vert.X Stomp

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32081.json · Exploit
• https://github.com/vert-x3/vertx-stomp · Nota
• https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-gvrq-cg5r-7chp · Aviso do Fabricante
• https://github.com/vert-x3/vertx-stomp/commit/0de4bc5a44ddb57e74d92c445f16456fa03f265b · Correção
• https://osv.dev/vulnerability/GHSA-gvrq-cg5r-7chp · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-32081 · Aviso do Fabricante
• https://t.me/cibsecurity/64030 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-32081 · Nota de Segurança