TI-2023-14271 Aliases CVE-2023-30428 GHSA-j2r7-3rvw-g7gx

Apache Pulsar Broker: Incorrect Authorization Validation for Rest Producer

LOW 39CWE-863Published 2023-07-12 · Updated 2024-10-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP header to produce a message to any topic using the broker's admin role. This issue affects Apache Pulsar Brokers: from 2.9.0 through 2.9.5, from 2.10.0 before 2.10.4, 2.11.0. The vulnerability is exploitable when an attacker can connect directly to the Pulsar Broker. If an attacker is connecting through the Pulsar Proxy, there is no known way to exploit this authorization vulnerability. There are two known risks for affected users. First, an attacker could produce garbage messages to any topic in the cluster. Second, an attacker could produce messages to the topic level policies topic for other tenants and influence topic settings that could lead to exfiltration and/or deletion of messages for other tenants. 2.8 Pulsar Broker users and earlier are unaffected. 2.9 Pulsar Broker users should upgrade to one of the patched versions. 2.10 Pulsar Broker users should upgrade to at least 2.10.4. 2.11 Pulsar Broker users should upgrade to at least 2.11.1. 3.0 Pulsar Broker users are unaffected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00819 57th percentileScored 2026-11-07

Fix Fixed Apache Pulsar Broker (Apache Software Foundation): 2.10.4org.apache.pulsar:pulsar-broker (Maven): 2.10.4, 2.11.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Pulsar Broker	2.9.0 – 2.9.5; 2.10.0 to before 2.10.4; 2.11.0	2.10.4	Patch available	CNA
—	org.apache.pulsar:pulsar-broker (Maven)	2.9.0 to before 2.10.4	2.10.4	Patch available	GHSA-j2r7-3rvw-g7gx
—	org.apache.pulsar:pulsar-broker (Maven)	2.11.0 to before 2.11.1	2.11.1	Patch available	GHSA-j2r7-3rvw-g7gx

Apache Pulsar Broker VendorApache Affected 2.9.0 – 2.9.5; 2.10.0 to before 2.10.4; 2.11.0 Fixed in 2.10.4 Patch available CNA
org.apache.pulsar:pulsar-broker (Maven) Vendor— Affected 2.9.0 to before 2.10.4 Fixed in 2.10.4 Patch available GHSA-j2r7-3rvw-g7gx
org.apache.pulsar:pulsar-broker (Maven) Vendor— Affected 2.11.0 to before 2.11.1 Fixed in 2.11.1 Patch available GHSA-j2r7-3rvw-g7gx

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:pulsar::::::::	2.9.0 – 2.9.5; 2.10.0 to before 2.10.4	Vulnerable	Apache
cpe:2.3:a:apache:pulsar:2.11.0:-::::::	2.11.0	Vulnerable	Apache
cpe:2.3:a:apache:pulsar:2.11.0:candidate_1::::::	2.11.0 candidate_1	Vulnerable	Apache
cpe:2.3:a:apache:pulsar:2.11.0:candidate_5::::::	2.11.0 candidate_5	Vulnerable	Apache

cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:* Versions 2.9.0 – 2.9.5; 2.10.0 to before 2.10.4 Vulnerable ·Apache
cpe:2.3:a:apache:pulsar:2.11.0:-:*:*:*:*:*:* Versions 2.11.0 Vulnerable ·Apache
cpe:2.3:a:apache:pulsar:2.11.0:candidate_1:*:*:*:*:*:* Versions 2.11.0 candidate_1 Vulnerable ·Apache
cpe:2.3:a:apache:pulsar:2.11.0:candidate_5:*:*:*:*:*:* Versions 2.11.0 candidate_5 Vulnerable ·Apache

Remediation

Fix · CNA Apache Pulsar Broker (Apache Software Foundation) Fixed in 2.10.4
Fix · GHSA-j2r7-3rvw-g7gx org.apache.pulsar:pulsar-broker (Maven) Fixed in 2.10.4 Advisory →
Fix · GHSA-j2r7-3rvw-g7gx org.apache.pulsar:pulsar-broker (Maven) Fixed in 2.11.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-30428
2026-10-03 Alias added: GHSA-j2r7-3rvw-g7gx

References

Advisory 2

Other 1

https://github.com/apache/pulsar

TI-2024-18155 Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification CVSS 3.1CRITICAL 9.9
TI-2021-05150 Authentication with JWT allows use of “none”-algorithm CVSS 3.1CRITICAL 9.8
TI-2024-17990 Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution CVSS 3.1CRITICAL 9.9
TI-2023-14272 Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy CVSS 3.1CRITICAL 9.6
TI-2022-15232 Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint CVSS 3.1HIGH 8.2
TI-2024-18500 Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying CVSS 3.1HIGH 8.8

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences