Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Users are recommended to upgrade to version 3.9.2, 3.8.4 which fixes the issue.
History

Mon, 02 Dec 2024 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat amq Streams
CPEs cpe:/a:redhat:amq_streams:2
Vendors & Products Redhat
Redhat amq Streams

Wed, 27 Nov 2024 02:45:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

threat_severity

Moderate


Fri, 15 Nov 2024 21:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published: 2024-03-15T10:26:12.848Z

Updated: 2024-11-15T21:06:11.154Z

Reserved: 2024-01-24T10:28:30.728Z

Link: CVE-2024-23944

cve-icon Vulnrichment

Updated: 2024-08-01T23:13:08.588Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-03-15T11:15:08.927

Modified: 2024-11-21T08:58:44.067

Link: CVE-2024-23944

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-03-15T10:26:12Z

Links: CVE-2024-23944 - Bugzilla