CVE-2019-0201

CVE-2019-0201: falha em Apache ZooKeeper

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Apache ZooKeeper+ Monitorar zookeeper

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 9.7%
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
Produtos afetados
Apache Software Foundation · Apache ZooKeeper
CVEs relacionadas — Apache ZooKeeper

No mesmo produto, das mais perigosas para as menos.

CVE-2017-5637—CVE-2017-5637EPSS 73.1%CVE-2018-8012—CVE-2018-8012EPSS 8.4%CVE-2023-44981CRITICALApache ZooKeeper: Authorization bypass in SASL Quorum Peer AuthenticationEPSS 2.2%CVE-2026-24308MEDIUMApache ZooKeeper: Sensitive information disclosure in client configuration handlingEPSS 1.3%CVE-2024-51504CRITICALApache ZooKeeper: Authentication bypass with IP-based authentication in Admin ServerEPSS 0.9%CVE-2026-84501MEDIUMApache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProviderEPSS 0.7%