CVE-2018-1288

CWE-94 — Code InjectionCWE-287 — Improper Authentication6 documents6 sources
Severity
5.4MEDIUM
EPSS
0.7%
top 28.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Oracle Timesten In-memory DatabaseApache KafkaOracle Primavera P6 Enterprise Project Portfolio Management+3 more
Timeline
PublishedJul 26
Latest updateMay 13

Description

In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:LExploitability: 2.8 | Impact: 2.5

Affected Packages7 packages

▶Mavenorg.apache.kafka:kafka0.9.0.0 — 0.10.2.2+2
▶NVDapache/kafka0.10.0.0 — 0.10.2.1+3
▶NVDoracle/database5 versions+4

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

3
OSV
Improper Control of Generation of Code in Apache Kafka↗2022-05-13
▶
GHSA
Improper Control of Generation of Code in Apache Kafka↗2022-05-13
▶
CVEList
CVE-2018-1288: In Apache Kafka 0↗2018-07-26
▶

📋Vendor Advisories

1
Red Hat
kafka: Users can perform Broker actions via crafted fetch requests, interfering with data replication and causing data lass↗2018-07-26
▶

💬Community

1
Bugzilla
CVE-2018-1288 kafka: Users can perform Broker actions via crafted fetch requests, interfering with data replication and causing data lass↗2018-08-02
▶
CVE-2018-1288 (MEDIUM CVSS 5.4) | In Apache Kafka 0.9.0.0 to 0.9.0.1 | cvebase.io