CVE-2020-27220

ALTO 8.8CVE-2020-27220 · Published 14/01/2021 · updated 17/06/2026

In breve

CVE-2020-27220 è una vulnerabilità ALTO (CVSS 8.8) che riguarda hono (eclipse).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.2%, superiore al 67.2% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
hono eclipse	`= 1.5.0≥ 1.4.0, ≤ 1.4.4`	No fix yet

Description

The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when it has subscribed only to commands for a specific device. The missing check involves verifying that the command target device is configured giving permission for the gateway device to act on its behalf. This means an authenticated device of a certain tenant, notably also a non-gateway device acting like a gateway, may receive command & control messages targeted at a different device of the same tenant without corresponding permissions getting checked.

References

bugs.eclipse.org/bugs/show_bug.cgi · Vendor Advisory

Altre vulnerabilità di hono

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free