CVE-2023-44981

CWE-639 — Insecure Direct Object Reference11 documents8 sources
Severity
9.1CRITICAL
EPSS
0.0%
top 93.29%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Apache Software Foundation Apache ZookeeperApache ZookeeperDebian Debian Linux
Timeline
PublishedOct 11
Latest updateApr 15

Description

Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like '[email protected]', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propa…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages4 packages

▶NVDapache/zookeeper3.8.0 — 3.8.3+2
▶Mavenorg.apache.zookeeper:zookeeper3.8.0 — 3.8.3+2
▶CVEListV5apache_software_foundation/apache_zookeeper3.9.0 — 3.9.1+3
▶Debianzookeeper< 3.4.13-6+deb11u1+3

Also affects: Debian Linux 10.0, 11.0, 12.0

🔴Vulnerability Details

5
OSV
zookeeper vulnerabilities↗2024-01-16
▶
GHSA
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper↗2023-10-11
▶
OSV
CVE-2023-44981: Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper↗2023-10-11
▶
OSV
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper↗2023-10-11
▶
CVEList
Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication↗2023-10-11
▶

📋Vendor Advisories

5
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Reports (Apache ZooKeeper) — CVE-2023-44981↗2024-04-15
▶
Ubuntu
ZooKeeper vulnerabilities↗2024-01-16
▶
Oracle
Oracle Oracle Communications Applications Risk Matrix: PSR Designer (Apache ZooKeeper) — CVE-2023-44981↗2024-01-15
▶
Red Hat
zookeeper: Authorization Bypass in Apache ZooKeeper↗2023-10-11
▶
Debian
CVE-2023-44981: zookeeper - Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeep...↗2023
▶