We found results for “”
CVE-2018-17196
Good to know:
Date: July 11, 2019
In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users should upgrade to 2.1.1 or later where this vulnerability has been fixed.
Language: Java
Severity Score
Related Resources (13)
Severity Score
Weakness Type (CWE)
Input Validation
CWE-20Insufficient Information
NVD-CWE-noinfoTop Fix
Upgrade Version
Upgrade to version org.apache.kafka:kafka-clients:2.1.1;org.apache.servicemix.bundles:org.apache.servicemix.bundles.kafka-clients:2.1.1_1
CVSS v3.1
Base Score: |
|
---|---|
Attack Vector (AV): | NETWORK |
Attack Complexity (AC): | LOW |
Privileges Required (PR): | LOW |
User Interaction (UI): | NONE |
Scope (S): | UNCHANGED |
Confidentiality (C): | HIGH |
Integrity (I): | HIGH |
Availability (A): | HIGH |
CVSS v2
Base Score: |
|
---|---|
Access Vector (AV): | NETWORK |
Access Complexity (AC): | LOW |
Authentication (AU): | SINGLE |
Confidentiality (C): | PARTIAL |
Integrity (I): | PARTIAL |
Availability (A): | PARTIAL |
Additional information: |