CVE-2023-32081: 
Java vulnerability analysis and mitigation

CVE-2023-32081 affects Vert.x STOMP, a Vert.x implementation of the STOMP specification that provides a STOMP server and client. The vulnerability was discovered in versions 3.1.0 through 3.9.16 and 4.0.0 through 4.4.2. The issue was disclosed on May 12, 2023 (NVD).

The vulnerability stems from the STOMP server processing client STOMP frames without verifying that the client has sent an initial CONNECT frame and received a successful CONNECTED frame response. This represents an improper authentication vulnerability (CWE-287). The vulnerability has a CVSS v3.1 base score of 6.5 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (NVD, GitHub Advisory).

The vulnerability allows clients to subscribe to destinations or publish messages without proper authentication. This affects any Vert.x STOMP server configured with an authentication handler, potentially compromising the security of the messaging system (GitHub Advisory).

The vulnerability can be exploited remotely by sending STOMP frames to the server without first establishing a proper authenticated connection. The attack requires no special privileges or user interaction, making it relatively straightforward to exploit (GitHub Advisory).

The vulnerability has been patched in Vert.x versions 3.9.16 and 4.4.2. There are no trivial workarounds available, so upgrading to a patched version is strongly recommended (GitHub Advisory).