Auth bypass in Eclipse Mosquitto
CVE-2018-12551
When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the password file will be treated as valid. This typically means that the malformed data becomes a username and no password. If this occurs, clients can circumvent authentication and get access to the broker by using the malformed username. In particular, a blank line will be treated as a valid empty username. Other security measures are unaffected. Users who have only used the mosquitto_passwd utility to create and modify their password files are unaffected by this vulnerability.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.015 (72.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 73rd percentile — 72.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: 0.000
Affected products
- Eclipse Mosquitto
- The Eclipse Foundation Mosquitto — versions 1.0, unspecified
Weakness classification (CWE)
References
- bugs.eclipse.org/bugs/show_bug.cgi (Exploit, Issue Tracking, Vendor Advisory)
- lists.debian.org/debian-lts-announce/2019/10/msg00035.html (mailing-list)
Frequently asked questions
- What is CVE-2018-12551?
- CVE-2018-12551 is a high-severity vulnerability in Eclipse Mosquitto, classified under CWE-703. CVSS score: 8.1/10. Published 2019-03-27.
- How severe is CVE-2018-12551?
- High severity. CVSS v3 base score is 8.1 out of 10.