CVE-2023-37544

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication.

This issue affects Apache Pulsar WebSocket Proxy: from 2.8.0 through 2.8.*, from 2.9.0 through 2.9.*, from 2.10.0 through 2.10.4, from 2.11.0 through 2.11.1, 3.0.0.

The known risks include a denial of service due to the WebSocket Proxy accepting any connections, and excessive data transfer due to misuse of the WebSocket ping/pong feature.

2.10 Pulsar WebSocket Proxy users should upgrade to at least 2.10.5. 2.11 Pulsar WebSocket Proxy users should upgrade to at least 2.11.2. 3.0 Pulsar WebSocket Proxy users should upgrade to at least 3.0.1. 3.1 Pulsar WebSocket Proxy users are unaffected. Any users running the Pulsar WebSocket Proxy for 2.8, 2.9, and earlier should upgrade to one of the above patched versions.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Dec 20, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-375456.5In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requestCVE-2023-375466.5In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requestCVE-2023-375476.5In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requestCVE-2023-375486.5In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requestCVE-2023-375496.5In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requestCVE-2023-37556.1A vulnerability has been found in Creativeitem Atlas Business Directory Listing 2.13 and classified as problematic. Affected by this vulneraCVE-2023-375506.5In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requestCVE-2023-375516.5In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requesCVE-2023-375526.5In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requestCVE-2023-375536.5In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requestCVE-2023-375546.5In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requestCVE-2023-375556.5In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication request
CVE-2023-37544: High severity, CVSS 7.5 | Vulnix