CVE-2021-41571

Katalog CVE

CVSS 6.5 · Medium EPSS 1,7%

Kerentanan Incorrect Authorization pada apache pulsar. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data, and it is supposed to be a valid it for the topic. Authorisation controls are performed against the topic name and there is not proper validation the that ledger id is valid in the context of such ledger. So it may happen that the user is able to read from a ledger that contains data owned by another tenant. This issue affects Apache Pulsar Apache Pulsar version 2.8.0 and prior versions; Apache Pulsar version 2.7.3 and prior versions; Apache Pulsar version 2.6.4 and prior versions.

Rincian

Terbit di NVD

1 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/8n3k7pvyh4cf9q2jfzb6pb32ync6xlvr mailing list · advisory vendor
• https://pulsar.apache.org/admin-rest-api/#operation/getLastMessageId patch · advisory vendor
• https://github.com/apache/pulsar/issues/11814 exploit · issue tracking · patch · advisory pihak ketiga