Поиск уязвимостей
Количество 7
Количество 7
CVE-2024-31141
Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products. This issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0. Users with affected applications are recommended t...
CVE-2024-31141
Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products. This issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0. Users with affected applications are recommended
GHSA-2x2g-32r7-p4x8
Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider
BDU:2024-10294
Уязвимость компонента Automatic ConfigProvider диспетчера сообщений Apache Kafka, позволяющая нарушителю раскрыть защищаемую информацию
ROS-20241216-09
Уязвимость apache-kafka
ALT-PU-2024-18025
ALT-PU-2024-18025: package `kafka` update to version 3.8.0-alt1
ALT-PU-2024-17915
ALT-PU-2024-17915: package `kafka` update to version 3.8.0-alt1
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2024-31141 Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products. This issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0. Users with affected applications are recommended t... | CVSS3: 5.3 | 1% Низкий | почти 2 года назад |
 | CVE-2024-31141 Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products. This issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0. Users with affected applications are recommended | CVSS3: 6.5 | 1% Низкий | почти 2 года назад |
| GHSA-2x2g-32r7-p4x8 Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider | CVSS3: 6.5 | 1% Низкий | почти 2 года назад |
 | BDU:2024-10294 Уязвимость компонента Automatic ConfigProvider диспетчера сообщений Apache Kafka, позволяющая нарушителю раскрыть защищаемую информацию | CVSS3: 6.5 | 1% Низкий | больше 2 лет назад |
 | ROS-20241216-09 Уязвимость apache-kafka | CVSS3: 6.5 | 1% Низкий | почти 2 года назад |
| ALT-PU-2024-18025 ALT-PU-2024-18025: package `kafka` update to version 3.8.0-alt1 | CVSS3: 6.5 | 1% Низкий | почти 2 года назад |
| ALT-PU-2024-17915 ALT-PU-2024-17915: package `kafka` update to version 3.8.0-alt1 | CVSS3: 6.5 | 1% Низкий | больше 2 лет назад |
Уязвимостей на страницу