| Vulnerability Name: | CVE-2018-12551 (CCN-156913) | ||||||||||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2018-06-18 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Published: | 2019-02-08 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Updated: | 2019-10-09 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Summary: | When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the password file will be treated as valid. This typically means that the malformed data becomes a username and no password. If this occurs, clients can circumvent authentication and get access to the broker by using the malformed username. In particular, a blank line will be treated as a valid empty username. Other security measures are unaffected. Users who have only used the mosquitto_passwd utility to create and modify their password files are unaffected by this vulnerability. | ||||||||||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 8.1 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) 7.1 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
| ||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-287 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2018-12551 Source: CONFIRM Type: Exploit, Issue Tracking, Vendor Advisory https://bugs.eclipse.org/bugs/show_bug.cgi?id=543401 Source: XF Type: UNKNOWN eclipse-mosquitto-cve201812551-sec-bypass(156913) Source: MLIST Type: UNKNOWN [debian-lts-announce] 20191026 [SECURITY] [DLA 1972-1] mosquitto security update Source: CCN Type: Mosquitto Web site An open source MQTT broker Source: CCN Type: Mosquitto Blog, 2019-02-08 Version 1.5.6 released Source: CCN Type: WhiteSource Vulnerability Database CVE-2018-12551 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||||||||||