1. CVE-Search
  2. CVE-2018-17196
ID CVE-2018-17196
Summary In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users should upgrade to 2.1.1 or later where this vulnerability has been fixed.
References
Vulnerable Configurations
  • cpe:2.3:a:apache:kafka:0.11.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:kafka:0.11.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:kafka:0.11.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:kafka:0.11.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:kafka:0.11.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:apache:kafka:0.11.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:kafka:0.11.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:apache:kafka:0.11.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:kafka:1.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:kafka:1.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:kafka:1.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:kafka:1.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:kafka:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:apache:kafka:1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:kafka:1.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:kafka:1.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:kafka:1.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:kafka:1.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:kafka:2.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:kafka:2.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:kafka:2.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:kafka:2.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:kafka:2.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:apache:kafka:2.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:kafka:2.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:kafka:2.1.0:*:*:*:*:*:*:*
CVSS
Base: 6.5 (as of 03-07-2021 - 21:15)
Impact:
Exploitability:
CWE NVD-CWE-noinfo
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:S/C:P/I:P/A:P
refmap via4
bid 109139
misc
mlist
  • [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities
  • [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
  • [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
  • [druid-commits] 20200406 [GitHub] [druid] ccaominh commented on issue #9579: Add Apache Ranger Authorization
  • [kafka-commits] 20190802 [kafka-site] branch asf-site updated: Add CVE-2018-17196, fix some links. (#223)
  • [kafka-commits] 20200115 [kafka-site] branch asf-site updated: Add CVE-2019-12399 (#250)
Last major update 03-07-2021 - 21:15
Published 11-07-2019 - 21:15
Last modified 03-07-2021 - 21:15
Back to Top