{"action":"Upgrade org.apache.pulsar:pulsar-websocket to 2.10.5 (2.10.x), 2.11.2 (2.11.x) or 3.0.1 (3.0.x) or later.","affected":[{"fixed":"2.10.5","introduced":"0"},{"fixed":"2.11.2","introduced":"2.11.0"},{"fixed":"3.0.1","introduced":"3.0.0"}],"component":"org.apache.pulsar:pulsar-websocket","cve_ids":["CVE-2023-37544"],"ecosystem":"Maven","epss":0.01351,"exploited":false,"fixed_versions":["2.10.5","2.11.2","3.0.1"],"ghsa_id":"GHSA-83q5-whqp-r8jr","id":"tcs_01M5N8KMVFPQSZ8V83R9QKA9GH","modified_at":"2024-02-16T08:23:30.318878Z","published_at":"2023-12-20T09:30:26Z","references":["https://osv.dev/vulnerability/GHSA-83q5-whqp-r8jr","https://nvd.nist.gov/vuln/detail/CVE-2023-37544","https://github.com/apache/pulsar/commit/11ee36d0351644a006d2a8639bdcc714fb602358","https://github.com/apache/pulsar/commit/894192fb6542e504be43034a3c33e90f9c6e528a","https://github.com/apache/pulsar/commit/eac263e8f2a93d3b9f707b97c7bbcbc2a826569f","https://github.com/apache/pulsar","https://lists.apache.org/thread/od0k9zts1toc9h9snbqq4pjpyx28mv4m","http://www.openwall.com/lists/oss-security/2023/12/20/2"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-83q5-whqp-r8jr","url":"https://osv.dev/vulnerability/GHSA-83q5-whqp-r8jr"}],"summary":"Apache Pulsar WebSocket Proxy contains an Improper Authentication vulnerability"}