CVE-2018-12546
Last modified
CVE-2018-12546 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that topic revoked, the retained message will still be published to clients that subscribe to that topic in the future. In some applications this may result in clients being able cause effects that would otherwise not be allowed.. EPSS estimates a 0.82% chance of exploitation in the next 30 days.
Description
In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that topic revoked, the retained message will still be published to clients that subscribe to that topic in the future. In some applications this may result in clients being able cause effects that would otherwise not be allowed.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Eclipse | Mosquitto | >= 1.0, <= 1.5.5 |
References
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=543127Exploit, Issue Tracking, Vendor Advisory
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=543127Exploit, Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-12546?
How severe is CVE-2018-12546?
How do I fix CVE-2018-12546?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-12540In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHa…
- CVE-2018-12541In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSoc…6.5
- CVE-2018-12542In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the Static…
- CVE-2018-12543In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a m…
- CVE-2018-12544In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the Op…
- CVE-2018-12545In Eclipse Jetty version 9.3.x and 9.4.x, the server is vuln…7.5
- CVE-2018-12547In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snpr…
- CVE-2018-12548In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the publi…
- CVE-2018-12549In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler ma…
- CVE-2018-1255RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 …6.1
- CVE-2018-12550When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is c…
- CVE-2018-12551When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is c…
Are you affected by CVE-2018-12546?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST