CVE-2018-12550 Auth bypass in Eclipse Mosquitto

What is CVE-2018-12550?

CVE-2018-12550 is a high-severity authentication bypass vulnerability in The Eclipse Foundation Eclipse Mosquitto, published on 27 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only comments or blank lines, then Mosquitto will treat this as though no ACL file has been defined and use a default allow policy. The new behaviour is to have an empty ACL file mean that all access is denied, which is not a useful configuration but is not unexpected.

Weakness: CWE-440

Which versions are affected by CVE-2018-12550?

It affects 1 product.

Products include Eclipse Mosquitto.

How do I fix CVE-2018-12550?

Apply the vendor's patch.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2018-12550 being exploited?

There is no known exploitation of CVE-2018-12550 in the wild and no public exploit code.

Other vulnerabilities in The Eclipse Foundation Eclipse Mosquitto

• CVE-2018-12551 Auth bypass in Eclipse Mosquitto High 8.1
• CVE-2023-5632 Unconditionally adding an event to the epoll causes excessive CPU consumption High 7.5
• CVE-2023-28366 Denial of service in n/a High 7.5
• CVE-2021-41039 Denial of service in Eclipse Mosquitto High 7.5
• CVE-2021-34432 Denial of service in Eclipse Mosquitto High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2018-12550, DEBIAN-CVE-2018-12550, GHSA-5cgw-j2m3-gxhw, UBUNTU-CVE-2018-12550.