CVE-2023-32081

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Vert.x STOMP is a vert.x implementation of the STOMP specification that provides a STOMP server and client. From versions 3.1.0 until 3.9.16 and 4.0.0 until 4.4.2, a Vert.x STOMP server processes client STOMP frames without checking that the client send an initial CONNECT frame replied with a successful CONNECTED frame. The client can subscribe to a destination or publish message without prior authentication. Any Vert.x STOMP server configured with an authentication handler is impacted. The issue is patched in Vert.x 3.9.16 and 4.4.2. There are no trivial workarounds.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: May 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-320824.3etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allo CVE-2023-320834.9Microsoft Failover Cluster Information Disclosure Vulnerability CVE-2023-320847.5HTTP.sys Denial of Service Vulnerability CVE-2023-320855.5Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability CVE-2023-320876.1Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation CVE-2023-320886.1Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation CVE-2023-320896.1Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description CVE-2023-32093.5The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a c CVE-2023-320909.8Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentials CVE-2023-320918.8Cross-Site Request Forgery (CSRF) vulnerability in POEditor plugin <= 0.9.4 versions.CVE-2023-320928.8Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plug CVE-2023-320938.8Cross-Site Request Forgery (CSRF) vulnerability in Criss Swaim TPG Redirect plugin <= 1.0.7 versions.