-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.pulsar:pulsar-broker | maven | >= 2.9.0, < 2.10.4 | 2.10.4 |
| org.apache.pulsar:pulsar-broker | maven | = 2.11.0 | 2.11.1 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability centers on improper authorization when using custom HTTP headers to assume admin privileges. The REST producer endpoint (ProducerWebResource.postMessage) is the primary entry point for message production via HTTP and would be responsible for parsing headers and enforcing authorization. ServerCnx.handleProducer is involved in producer creation and could propagate the improperly authorized role. The high confidence for ProducerWebResource.postMessage stems from its direct role in REST message production, while ServerCnx.handleProxyProtocolHeader receives medium confidence due to its potential role in processing client connections. The absence of patch details limits absolute certainty, but these functions align with the described attack vector and authorization flaw.
Ongoing coverage of React2Shell