{"id":"CVE-2018-3778","aliases":["EUVD-2018-0363","GHSA-4cmx-hrq9-c23p"],"status":"published","title":"Improper Authorization in aedes","description":"Improper authorization in aedes version \u003c0.35.0 will publish a LWT in a channel when a client is not authorized.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01417,"percentile":0.72937,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285","CWE-863"],"published":"2018-08-08T20:00:00Z","modified":"2026-10-20T10:50:28Z","fixes":[{"ecosystem":"npm","package":"aedes","fixed_in":["0.35.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"aedes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.35.1"}]}]},{"source":"osv","ecosystem":"npm","package":"aedes","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.35.1"}]}]}],"products":[{"vendor":"aedes_project","product":"aedes"},{"vendor":"hackerone","product":"aedes"}],"references":[{"url":"https://github.com/nodejs/security-wg/blob/master/vuln/npm/457.json","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/mcollina/aedes/issues/212","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/mcollina/aedes/issues/211","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-3778","tags":["advisory"]},{"url":"https://github.com/moscajs/aedes/issues/211","tags":["web"]},{"url":"https://github.com/moscajs/aedes/issues/212","tags":["web"]},{"url":"https://github.com/moscajs/aedes/commit/ffbc1702bb24b596afbb96407cc6db234a4044a8","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4cmx-hrq9-c23p"},{"url":"https://github.com/moscajs/aedes","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2018-3778","description":"Improper authorization in aedes version \u003c0.35.0 will publish a LWT in a channel when a client is not authorized.","status":"published","published":"2018-08-08T20:00:00Z","modified":"2024-09-16T18:18:21.081Z","cwes":["CWE-285"],"updated_at":"2026-11-02T14:35:05.262903Z"}],"euvd":[{"id":"EUVD-2018-0363","description":"Improper authorization in aedes version \u003c0.35.0 will publish a LWT in a channel when a client is not authorized.","status":"published","published":"2018-08-08T20:00:00Z","modified":"2024-09-16T18:18:21Z","updated_at":"2026-11-03T00:55:33.878386Z"}],"ghsa":[{"id":"GHSA-4cmx-hrq9-c23p","title":"Improper Authorization in aedes","description":"Versions of `aedes` before 0.35.1 does not respect its own authorization rules when a client sets a `Last Will`.\n\n\n## Recommendation\n\nUpdate to version 0.35.1 or later.","status":"published","published":"2018-08-15T20:03:22Z","modified":"2023-04-21T18:30:55Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-285","CWE-863"],"updated_at":"2026-11-02T14:36:51.39133Z"}],"nvd":[{"id":"CVE-2018-3778","description":"Improper authorization in aedes version \u003c0.35.0 will publish a LWT in a channel when a client is not authorized.","status":"published","published":"2018-08-08T20:29:00.22Z","modified":"2026-06-17T01:57:48.75Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-285","CWE-863"],"updated_at":"2026-11-02T14:04:35.310988Z"}],"osv":[{"id":"CVE-2018-3778","description":"Improper authorization in aedes version \u003c0.35.0 will publish a LWT in a channel when a client is not authorized.","status":"published","published":"2018-08-08T20:29:00.22Z","modified":"2026-10-20T10:50:28.058775333Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:09.442568Z"},{"id":"GHSA-4cmx-hrq9-c23p","title":"Improper Authorization in aedes","description":"Versions of `aedes` before 0.35.1 does not respect its own authorization rules when a client sets a `Last Will`.\n\n\n## Recommendation\n\nUpdate to version 0.35.1 or later.","status":"published","published":"2018-08-15T20:03:22Z","modified":"2023-11-08T04:00:19.875821Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-285","CWE-863"],"updated_at":"2026-11-02T15:46:36.782754Z"}]}}