CVE-2018-3778

Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized.

Score

CVSS 3.1 5.3 Medium

Status

Modified - support@hackerone.com

Published

2018-08-08

Last modified

2024-09-16

Weaknesses

CWE-285, CWE-863

Affected products

• Aedes (Aedes Project)
• Aedes (Hackerone)

References

• https://github.com/mcollina/aedes/issues/211
• https://github.com/mcollina/aedes/issues/212
• https://github.com/nodejs/security-wg/blob/master/vuln/npm/457.json