Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.cometd.java:cometd-java-oort

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.1MavenPublished

    Improper Authorization in org.cometd.oort

    CVE-2022-24721 · GHSA-rjmq-6v55-4rjv

    Affected
    • Maven org.cometd.java:cometd-java-oort < 5.0.11; >= 6.0.0, < 6.0.6; >= 7.0.0, < 7.0.6
    Fixed in
    5.0.117.0.66.0.6· Vendor fix available
    Issue
    Impact Internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels. By subscribing to those channels, a remote user may be able to watch cluster-internal traffic that contains other user's (possibly sensitive) data. By publishing to those channels, a remote user may be able to create/modify/delete other user's data and modify the cluster structure. The issue impacts any version up to 5.0.10, 6.0.5 and 7.0.5. Patches The issue has been fixed in 5.0.11, 6.0.6 and 7.0.6. Workarounds The workaround is to install a custom SecurityPolicy that forbids subscription and publishing to remote, non-Oort, sessions on Oort and Seti channels. This workaround could be implemented in any affected version. References cometd/cometd#1146 For more information If you have any questions or comments about this advisory: Email us at security@webtide.com Credits https://www.redteam-pentesting.de/

    Recommended action: Upgrade to 7.0.6, 6.0.6 or 5.0.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →