Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1xMnh4LWY4cjMtOW1nNc4AA9It

STRIMZI incorrect access control

Incorrect access control in the Kafka Connect REST API in the STRIMZI Project 0.41.0 and earlier allows an attacker to deny the service for Kafka Mirroring, potentially mirror the topics' content to his Kafka cluster via a malicious connector (bypassing Kafka ACL if it exists), and potentially steal Kafka SASL credentials, by querying the MirrorMaker Kafka REST API.

Permalink: https://github.com/advisories/GHSA-q2xx-f8r3-9mg5
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xMnh4LWY4cjMtOW1nNc4AA9It
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 4 months ago
Updated: 3 months ago

CVSS Score: 7.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Identifiers: GHSA-q2xx-f8r3-9mg5, CVE-2024-36543
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-36543
• https://github.com/almounah/vulnerability-research/tree/main/CVE-2024-36543
• http://strimzi.com
• https://github.com/advisories/GHSA-q2xx-f8r3-9mg5

Repository: https://github.com/almounah/vulnerability-research
Blast Radius: 1.0

Affected Packages