CVSS 3.1 Score 6.4 of 10 (medium)


Published Mar 12, 2024
Updated: Mar 13, 2024
CWE ID 863


CVE-2024-28098 is a vulnerability that affects Apache Pulsar versions from 2.7.1 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0, allowing authenticated users with produce or consume permissions to modify topic-level policies that should be restricted to users with higher roles like tenant admin or super user. To remediate this vulnerability, users should upgrade their Apache Pulsar version to at least the following patched versions: 2.10 users should upgrade to at least 2.10.6, 2.11 users should upgrade to at least 2.11.4, 3.0 users should upgrade to at least 3.0.3, 3.1 users should upgrade to at least 3.1., and for version 3.. Users operating on older versions are advised to also upgrade to the mentioned patched versions or newer ones in order to ensure security and prevent potential unauthorized modifications of topic-level policies by lower privileged users with produce or consume permissions

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-28098 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options