Pulsar vulnerabilities

9 known vulnerabilities in Pulsar from Apache. 9 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  The Pulsar Functions Worker includes a capability that permits authenticated users to create…

  CVE-2024-27894Mar 12, 2024ApacheEPSS 1.9%

  The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a URL. The supported URL schemes include "file", "http", and "https". When a function is created using t

• 9.9 Critical severity

  Apache Pulsar: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2024-27317Mar 12, 2024ApacheEPSS 56.9%

  In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability.

• 9.9 Critical severity

  Improper input validation in the Pulsar Function Worker allows a malicious authenticated user…

  CVE-2024-27135Mar 12, 2024ApacheEPSS 5.98%

  Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, outside of the sandboxes designated for running user-provided functions. This vulnerability also applies

• 8.2 High severity

  Apache Pulsar: Missing Authentication for Critical Functionality

  CVE-2022-34321Mar 12, 2024ApacheEPSS 1.76%

  Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable endpoint exposes detailed statistics about live connections, along with the capability to modify the

• 7.4 High severity

  Apache Pulsar: Observable Discrepancy

  CVE-2023-51437Feb 7, 2024Apache

  Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes th

• 7.5 High severity

  Apache Pulsar WebSocket Proxy: Improper Authentication

  CVE-2023-37544Dec 20, 2023ApacheEPSS 1.35%

  Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication. This issue affects Apache Pulsar WebSocket Proxy: from 2.8.0 through 2.8.*, from 2.9.0 through 2.9.*, from 2.

• 8.8 High severity

  Apache Pulsar: Incorrect Authorization

  CVE-2023-30429Jul 12, 2023ApacheEPSS 1.03%

  Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. When a client connects to the Pulsar Function Worker via the Pulsar Proxy where the Pulsar Proxy uses mTLS authentic

• 8.1 High severity

  Apache Pulsar Broker: Incorrect Authorization

  CVE-2023-30428Jul 12, 2023Apache

  Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP header to produce a message to any topic using the broker's admin role. This issue affects Apache Pulsar Broke

• 8.1 High severity

  Apache Pulsar: Improper Certificate Validation

  CVE-2022-33684Nov 4, 2022Apache

  The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureConnection is disabled via configuration. This vulnerability allows an attacker to perform a man in th