PT-2018-16196 · Mosquitto · Aedes

Matteo Collina + 1 · Published 2018-08-08 · Updated 2023-02-28 · CVE-2018-3778

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions aedes versions prior to 0.35.1

Description The issue is related to improper authorization, where aedes does not respect its own authorization rules when a client sets a Last Will. This can lead to publishing a Last Will and Testament (LWT) in a channel even when the client is not authorized.

Recommendations Update to version 0.35.1 or later.

Fix

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

CVE-2018-3778

GHSA-4CMX-HRQ9-C23P

Affected Products

Aedes

References · 10

• https://github.com/mcollina/aedes/issues/211 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-3778 · Security Note
• https://osv.dev/vulnerability/CVE-2018-3778 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4cmx-hrq9-c23p · Vendor Advisory
• https://github.com/mcollina/aedes/issues/212 · Note
• https://github.com/moscajs/aedes · Note
• https://github.com/moscajs/aedes/issues/211 · Note
• https://github.com/moscajs/aedes/commit/ffbc1702bb24b596afbb96407cc6db234a4044a8 · Note
• https://github.com/moscajs/aedes/issues/212 · Note
• https://github.com/nodejs/security-wg/blob/master/vuln/npm/457.json · Note