What is CVE-2018-12546?

CVE-2018-12546 is a medium-severity vulnerability in Eclipse Mosquitto, classified under Improper Access Control. CVSS score: 6.5/10. Published 2019-03-27.

How severe is CVE-2018-12546?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Eclipse Mosquitto

CVE-2018-12546

In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that topic revoked, the retained message will still be published to clients that subscribe to that topic in…

EPSS: 0.008 (52.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

Affected products

Eclipse Mosquitto
The Eclipse Foundation Mosquitto — versions 1.0, unspecified

Weakness classification (CWE)

CWE-284 — Improper Access Control
CWE-732 — Incorrect Permission Assignment for Critical Resource

References

emo@eclipse.org (x_refsource_CONFIRM, Exploit, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2018-12546?: CVE-2018-12546 is a medium-severity vulnerability in Eclipse Mosquitto, classified under Improper Access Control. CVSS score: 6.5/10. Published 2019-03-27.
How severe is CVE-2018-12546?: Medium severity. CVSS v3 base score is 6.5 out of 10.