GitHub Advisoryadvisory · npm

GHSA-4cmx-hrq9-c23p Improper Authorization in aedes

MEDIUM Published 2018-08-15 Modified 2023-04-21 Official page ↗
Aliases
CVE-2018-3778
Ecosystem
npm
Packages
aedes
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-285, CWE-863
Reviewed
2020-06-16

Affected packages

• npm aedes: < 0.35.1 → fixed in 0.35.1

Description

Versions of `aedes` before 0.35.1 does not respect its own authorization rules when a client sets a `Last Will`. Recommendation Update to version 0.35.1 or later.

Related

Alias · CVE (1)

  • CVE-2018-3778 Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized. vulnerability

Weakness · CWE (2)

  • CWE-285 Improper Authorization weakness
  • CWE-863 Incorrect Authorization weakness

References