Security Advisory

CVE-2017-7650

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2017-09-11 16:00:00

Last updated 2024-09-16 20:43:01

Assigner eclipse

CVSS score not scored

State PUBLISHED

Description

In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access control plugins for Mosquitto.

← Browse all CVEs View on cve.org ↗