TI-2023-19177 Aliases CVE-2023-37579 GHSA-74mc-g2xv-pch2

Apache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source Credentials

LOW 39CWE-863Published 2023-07-12 · Updated 2024-10-08

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Function Worker. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. Any authenticated user can retrieve a source's configuration or a sink's configuration without authorization. Many sources and sinks contain credentials in the configuration, which could lead to leaked credentials. This vulnerability is mitigated by the fact that there is not a known way for an authenticated user to enumerate another tenant's sources or sinks, meaning the source or sink name would need to be guessed in order to exploit this vulnerability. The recommended mitigation for impacted users is to upgrade the Pulsar Function Worker to a patched version. 2.10 Pulsar Function Worker users should upgrade to at least 2.10.4. 2.11 Pulsar Function Worker users should upgrade to at least 2.11.1. 3.0 Pulsar Function Worker users are unaffected. Any users running the Pulsar Function Worker for 2.9.* and earlier should upgrade to one of the above patched versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00819 57th percentileScored 2026-11-07

Fix Fixed Apache Pulsar Function Worker (Apache Software Foundation): 2.10.4org.apache.pulsar:pulsar-functions-worker (Maven): 2.10.4, 2.11.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Pulsar Function Worker	before 2.10.4; 2.11.0	2.10.4	Patch available	CNA
—	org.apache.pulsar:pulsar-functions-worker (Maven)	before 2.10.4	2.10.4	Patch available	GHSA-74mc-g2xv-pch2
—	org.apache.pulsar:pulsar-functions-worker (Maven)	2.11.0 to before 2.11.1	2.11.1	Patch available	GHSA-74mc-g2xv-pch2

Apache Pulsar Function Worker VendorApache Affected before 2.10.4; 2.11.0 Fixed in 2.10.4 Patch available CNA
org.apache.pulsar:pulsar-functions-worker (Maven) Vendor— Affected before 2.10.4 Fixed in 2.10.4 Patch available GHSA-74mc-g2xv-pch2
org.apache.pulsar:pulsar-functions-worker (Maven) Vendor— Affected 2.11.0 to before 2.11.1 Fixed in 2.11.1 Patch available GHSA-74mc-g2xv-pch2

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:pulsar::::::::	before 2.10.4	Vulnerable	Apache
cpe:2.3:a:apache:pulsar:2.11.0:-::::::	2.11.0	Vulnerable	Apache
cpe:2.3:a:apache:pulsar:2.11.0:candidate_1::::::	2.11.0 candidate_1	Vulnerable	Apache
cpe:2.3:a:apache:pulsar:2.11.0:candidate_5::::::	2.11.0 candidate_5	Vulnerable	Apache

cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:* Versions before 2.10.4 Vulnerable ·Apache
cpe:2.3:a:apache:pulsar:2.11.0:-:*:*:*:*:*:* Versions 2.11.0 Vulnerable ·Apache
cpe:2.3:a:apache:pulsar:2.11.0:candidate_1:*:*:*:*:*:* Versions 2.11.0 candidate_1 Vulnerable ·Apache
cpe:2.3:a:apache:pulsar:2.11.0:candidate_5:*:*:*:*:*:* Versions 2.11.0 candidate_5 Vulnerable ·Apache

Remediation

Fix · CNA Apache Pulsar Function Worker (Apache Software Foundation) Fixed in 2.10.4
Fix · GHSA-74mc-g2xv-pch2 org.apache.pulsar:pulsar-functions-worker (Maven) Fixed in 2.10.4 Advisory →
Fix · GHSA-74mc-g2xv-pch2 org.apache.pulsar:pulsar-functions-worker (Maven) Fixed in 2.11.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-37579
2026-10-03 Alias added: GHSA-74mc-g2xv-pch2

References

Advisory 2

Other 1

https://github.com/apache/pulsar

TI-2024-18155 Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification CVSS 3.1CRITICAL 9.9
TI-2021-05150 Authentication with JWT allows use of “none”-algorithm CVSS 3.1CRITICAL 9.8
TI-2024-17990 Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution CVSS 3.1CRITICAL 9.9
TI-2023-14272 Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy CVSS 3.1CRITICAL 9.6
TI-2022-15232 Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint CVSS 3.1HIGH 8.2
TI-2024-18500 Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying CVSS 3.1HIGH 8.8

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences