CVE-2017-9868
Publication date 25 June 2017
Last updated 25 August 2025
Ubuntu priority
Description
In Mosquitto through 1.4.12, mosquitto.db (aka the persistence file) is world readable, which allows local users to obtain sensitive MQTT topic information.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| mosquitto | 18.04 LTS bionic |
Not affected
|
| 16.04 LTS xenial |
Fixed 1.4.8-1ubuntu0.16.04.2
|
|
| 14.04 LTS trusty |
Fixed 0.15-2ubuntu1.2
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
5.5 · Medium
|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |