CyberRota Analysis
AI-GeneratedMoquette, a lightweight Java MQTT broker, is vulnerable due to improper handling of authentication and authorization failures, which can lead to the broker starting with these security controls disabled. This critical flaw (CVSS 9.3) poses a significant risk, as it allows unauthorized access to the broker if misconfigurations occur. Organizations using versions prior to 0.18.1 should prioritize upgrading to mitigate potential security breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1.
Related CVEs
Other vulnerabilities affecting the same vendor(s)