Incorrect Authorization in org.cometd.oort
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.
Summary
CometD is a scalable comet implementation for web messaging. In any version prior to 5.0.11, 6.0.6, and 7.0.6, internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels. By subscribing to those channels, a remote user may be able to watch cluster-internal traffic that contains other users' (possibly sensitive) data. By publishing to those channels, a remote user may be able to create/modify/delete other user's data and modify the cluster structure. A fix is available in versions 5.0.11, 6.0.6, and 7.0.6. As a workaround, install a custom `SecurityPolicy` that forbids subscription and publishing to remote, non-Oort, sessions on Oort and Seti channels.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| cometd | cometd | before 5.0.11; 6.0.0 to before 6.0.6; 7.0.0 to before 7.0.6 | 5.0.11, 6.0.6, 7.0.6 | Patch available | CNA |
| — | org.cometd.java:cometd-java-oort (Maven) | before 5.0.11 | 5.0.11 | Patch available | GHSA-rjmq-6v55-4rjv |
| — | org.cometd.java:cometd-java-oort (Maven) | 6.0.0 to before 6.0.6 | 6.0.6 | Patch available | GHSA-rjmq-6v55-4rjv |
| — | org.cometd.java:cometd-java-oort (Maven) | 7.0.0 to before 7.0.6 | 7.0.6 | Patch available | GHSA-rjmq-6v55-4rjv |
- cometd Vendorcometd Affected before 5.0.11; 6.0.0 to before 6.0.6; 7.0.0 to before 7.0.6 Fixed in 5.0.11, 6.0.6, 7.0.6 Patch available CNA
- org.cometd.java:cometd-java-oort (Maven) Vendor— Affected before 5.0.11 Fixed in 5.0.11 Patch available GHSA-rjmq-6v55-4rjv
- org.cometd.java:cometd-java-oort (Maven) Vendor— Affected 6.0.0 to before 6.0.6 Fixed in 6.0.6 Patch available GHSA-rjmq-6v55-4rjv
- org.cometd.java:cometd-java-oort (Maven) Vendor— Affected 7.0.0 to before 7.0.6 Fixed in 7.0.6 Patch available GHSA-rjmq-6v55-4rjv
Remediation
- Fix · CNA cometd (cometd) Fixed in 5.0.11, 6.0.6, 7.0.6
- Fix · GHSA-rjmq-6v55-4rjv org.cometd.java:cometd-java-oort (Maven) Fixed in 5.0.11 Advisory →
- Fix · GHSA-rjmq-6v55-4rjv org.cometd.java:cometd-java-oort (Maven) Fixed in 6.0.6 Advisory →
- Fix · GHSA-rjmq-6v55-4rjv org.cometd.java:cometd-java-oort (Maven) Fixed in 7.0.6 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Integration Data Virtualisation Operator | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
Not affected: 4 products
- Red Hat Fuse 7
- Red Hat Integration Camel K 1
- Red Hat Integration Camel Quarkus 1
- Red Hat build of Quarkus
Timeline
- 2026-10-02 Threatist record created from CVE-2022-24721
- 2026-10-03 Alias added: GHSA-rjmq-6v55-4rjv
References
Sources
- CVE-2022-24721 · CVE Program
- CVE-2022-24721 · NVD
- FIRST EPSS
- GHSA-rjmq-6v55-4rjv · GitHub Advisory Database · CC BY 4.0
- CVE-2022-24721 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences