Back to search
CVE-2017-7650
Published: Sep 11, 2017
Modified: Sep 16, 2024
PUBLISHED
Description
In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access control plugins for Mosquitto.
| Vendor | Product | Versions |
|---|---|---|
Eclipse Foundation | Mosquitto | affected 0.15 to 1.4.11 inclusive |
References
http://mosquitto.org/2017/05/security-advisory-cve-2017-7650/
x_refsource_CONFIRM
98741
vdb-entry
x_refsource_BID
DSA-3865
vendor-advisory
x_refsource_DEBIAN
https://bugs.eclipse.org/bugs/show_bug.cgi?id=516765
x_refsource_CONFIRM
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now