CVE-2022-33683

Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middle attacks, which could leak authentication data, configuration data, and any other data sent by these clients. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack. This issue affects Apache Pulsar Broker and Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier.

• CWE-295
• CWE-295

• https://lists.apache.org/thread/42v5rsxj36r3nhfxhmhb2x12r5jmvx3xMailing List, Vendor Advisory
• https://lists.apache.org/thread/42v5rsxj36r3nhfxhmhb2x12r5jmvx3xMailing List, Vendor Advisory

Published

Sep 23, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-33678Azure Site Recovery Remote Code Execution Vulnerability7.2
• CVE-2022-33679Windows Kerberos Elevation of Privilege Vulnerability8.1
• CVE-2022-3368A vulnerability within the Software Updater functionality of…8.8
• CVE-2022-33680Microsoft Edge (Chromium-based) Elevation of Privilege Vulne…8.3
• CVE-2022-33681Delayed TLS hostname verification in the Pulsar Java Client …5.9
• CVE-2022-33682TLS hostname verification cannot be enabled in the Pulsar Br…5.9
• CVE-2022-33684The Apache Pulsar C++ Client does not verify peer TLS certif…8.1
• CVE-2022-33685Unprotected dynamic receiver in Wearable Manager Service pri…5.5
• CVE-2022-33686Exposure of Sensitive Information in GsmAlarmManager prior t…2.3
• CVE-2022-33687Exposure of Sensitive Information in telephony-common.jar pr…3.3
• CVE-2022-33688Sensitive information exposure vulnerability in EventType in…3.3
• CVE-2022-33689Improper access control vulnerability in TelephonyUI prior t…3.3