FKIE_CVE-2022-33683

Vulnerability from fkie_nvd - Published: 2022-09-23 10:15 - Updated: 2025-05-22 19:15
Severity ?
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middle attacks, which could leak authentication data, configuration data, and any other data sent by these clients. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack. This issue affects Apache Pulsar Broker and Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier.
References
security@apache.orghttps://lists.apache.org/thread/42v5rsxj36r3nhfxhmhb2x12r5jmvx3xMailing List, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread/42v5rsxj36r3nhfxhmhb2x12r5jmvx3xMailing List, Vendor Advisory
Impacted products
Vendor Product Version
apache pulsar *
apache pulsar *
apache pulsar *
apache pulsar 2.10.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1329962E-1B1C-42B1-B3E3-B647B7D2749E",
              "versionEndExcluding": "2.7.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "02284ABD-BFD3-4E2A-850A-CC12A7996E97",
              "versionEndExcluding": "2.8.4",
              "versionStartIncluding": "2.8.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C1A2D87A-55FC-42C0-BB48-E2B5B07EE1CE",
              "versionEndExcluding": "2.9.3",
              "versionStartIncluding": "2.9.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:pulsar:2.10.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "C6E2F16D-CCDD-4DC8-9745-09EA2CD4D4DB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client\u0027s intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middle attacks, which could leak authentication data, configuration data, and any other data sent by these clients. An attacker can only take advantage of this vulnerability by taking control of a machine \u0027between\u0027 the client and the server. The attacker must then actively manipulate traffic to perform the attack. This issue affects Apache Pulsar Broker and Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier."
    },
    {
      "lang": "es",
      "value": "Apache Pulsar Brokers and Proxies crean un Pulsar Admin Client interno que no verifica los certificados TLS de los compa\u00f1eros, incluso cuando tlsAllowInsecureConnection est\u00e1 deshabilitado por medio de la configuraci\u00f3n. Las conexiones HTTPS intra-cl\u00faster y de geo-replicaci\u00f3n del Pulsar Admin Client son vulnerables a ataques de tipo man in the middle, que podr\u00edan filtrar datos de autenticaci\u00f3n, datos de configuraci\u00f3n y cualquier otro dato enviado por estos clientes. Un atacante s\u00f3lo puede aprovecharse de esta vulnerabilidad al tomar el control de una m\u00e1quina \"entre\" el cliente y el servidor. El atacante debe entonces manipular activamente el tr\u00e1fico para llevar a cabo el ataque. Este problema afecta a Apache Pulsar Broker y Proxy versiones 2.7.0 a 2.7.4; 2.8.0 a 2.8.3; 2.9.0 a 2.9.2; 2.10.0; 2.6.4 y anteriores."
    }
  ],
  "id": "CVE-2022-33683",
  "lastModified": "2025-05-22T19:15:33.067",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2022-09-23T10:15:10.353",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "https://lists.apache.org/thread/42v5rsxj36r3nhfxhmhb2x12r5jmvx3x"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "https://lists.apache.org/thread/42v5rsxj36r3nhfxhmhb2x12r5jmvx3x"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.