CVE-2023-31007 json
Apache Pulsar: Broker does not always disconnect client when authentication data expires
published 2023-07-12 3 y ago modified 2026-06-17 4 mo ago also GHSA-47r2-phr8-m8cp , EUVD-2023-1947
- cvss
- 0.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication data expires if the client connected through the Pulsar Proxy when the broker is configured with authenticateOriginalAuthData=false or if a client connects directly to a broker with a specially crafted connect command when the broker is configured with authenticateOriginalAuthData=false.
This issue affects Apache Pulsar: through 2.9.4, from 2.10.0 through 2.10.3, 2.11.0.
2.9 Pulsar Broker users should upgrade to at least 2.9.5. 2.10 Pulsar Broker users should upgrade to at least 2.10.4. 2.11 Pulsar Broker users should upgrade to at least 2.11.1. 3.0 Pulsar Broker users are unaffected. Any users running the Pulsar Broker for 2.8.* and earlier should upgrade to one of the above patched versions.
Patch / fix
- maven org.apache.pulsar:pulsar-broker 2.10.4, 2.11.1
- Apache Software Foundation Apache Pulsar 2.9.5
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
1.02% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 0.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.pulsar:pulsar-broker | >=2.9.0, <2.10.4 >=2.11.0, <2.11.1 |
2.10.4 2.11.1 |
Affected products
- Apache Software Foundation Apache Pulsar
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
lists.apache.org
/thread/qxn99xxyp0zv6jchjggn3soyo5gvqfxj
vendor-advisory, web, mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2023-31007
advisory
-
github.com
/apache/pulsar
package
Sources
- CVE List CVE-2023-31007
- GitHub Advisory GHSA-47r2-phr8-m8cp
- NVD CVE-2023-31007
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.