CVE-2021-41571

mediumPriorität · verfolgen · 27OT-Risiko · erhöhtEPSS 0.017 · 77. PerzentilEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.73% (77th) EPSS

CVSS 4 · medium

Is it mine?

7 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · bewertet 2026-10-27

In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data, and it is supposed to be a valid it for the topic. Authorisation controls are performed against the topic name and there is not proper validation the that ledger id is valid in the context of such ledger. So it may happen that the user is able to read from a ledger that contains data owned by another tenant. This issue affects Apache Pulsar Apache Pulsar version 2.8.0 and prior versions; Apache Pulsar version 2.7.3 and prior versions; Apache Pulsar version 2.6.4 and prior versions.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.04mediumAV:N/AC:L/Au:S/C:P/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 8 · Auswirkung 2.9

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 3.6

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · OSV

v3.16mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-20USCWE-863USCWE-863US

betroffene Produkte (7)

Betroffene Produkte und Versionsbereiche.

Apache Software Foundation Apache Pulsar≤ Apache Pulsar ≤2.8.0enisa_euvdEU
apache pulsar2.6.0 → 2.6.4nvdUScpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*
apache pulsar2.7.0 → 2.7.3nvdUScpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*
apache pulsar= 2.8.0nvdUScpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*
Maven org.apache.pulsar:pulsar≤ 2.6.4osvUSpkg:maven/org.apache.pulsar/pulsar
Maven org.apache.pulsar:pulsar2.7.0 → 2.7.4osvUSpkg:maven/org.apache.pulsar/pulsar
Maven org.apache.pulsar:pulsar2.8.0 → 2.8.1osvUSpkg:maven/org.apache.pulsar/pulsar

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

GHSA-3whx-qrj5-hh2hImproper Input Validation in Apache Pulsar2022-02-02ghsa · osvUS
In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data, and it is supposed to be a valid it for the topic. Authorisation controls are performed against the topic name and there is not proper validation the that ledger id is valid in the context of such ledger. So it may happen that the user is able to read from a ledger that contains data owned by another tenant. This issue affects Apache Pulsar Apache Pulsar version 2.8.0 and prior versions; Apache Pulsar version 2.7.3 and prior versions; Apache Pulsar version 2.6.4 and prior versions.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

veröffentlicht 2022-02-01geändert 2026-06-17

Referenzen (11)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan