CVE-2024-27894
CVSS 3.1 Score 8.5 of 10 (high)
Details
Summary
CVE-2024-27894: A vulnerability in the Apache Pulsar Functions Worker and Broker allows authenticated users to create functions using URLs, introducing a risk of unauthorized file access. This issue enables attackers to read any file the Pulsar Functions Worker process can access, potentially revealing sensitive information such as secrets. Moreover, an attacker could use this vulnerability as a proxy to access remote HTTP and HTTPS endpoints, leading to denial of service attacks. Versions 2.10.5 and earlier, 2.11.3 and earlier, 3.0.2 and earlier, 3.1.2 and earlier, and 3.2.0 are affected. Users should upgrade to 2.10.6, 2.11.4, 3.0.3, 3.1.3, and 3.2.1, respectively, or the latest patched versions. The updated versions impose restrictions on URL-based function creation but allow configuring permitted URL patterns.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions