Description

Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized.

Remediation

References

https://github.com/mcollina/aedes/issues/211

https://github.com/mcollina/aedes/issues/212

https://github.com/nodejs/security-wg/blob/master/vuln/npm/457.json

Related Vulnerabilities

CVE-2022-40149 Vulnerability in maven package org.codehaus.jettison:jettison

CVE-2020-6429 Vulnerability in maven package org.webjars.npm:electron

CVE-2023-46233 Vulnerability in npm package crypto-js

CVE-2020-24616 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind

CVE-2023-3894 Vulnerability in maven package com.fasterxml.jackson.dataformat:jackson-dataformat-properties

Severity

Medium

Classification

CWE-863 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Issue Tracking Patch Third Party Advisory