CVE-2024-23944
published 2024-03-15CVE-2024-23944: Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching…
PriorityP424medium5.3CVSS 3.1
AVLACLPRLUINSUCLILAL
EPSS
0.25%
15.9th percentile
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade to version 3.9.2, 3.8.4 which fixes the issue.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | zookeeper | >= 0 < 3.8.0-11+deb12u2 | 3.8.0-11+deb12u2 |
| apache | zookeeper | >= 0 < 3.9.2-1 | 3.9.2-1 |
| apache | zookeeper | >= 0 < 3.9.2-1 | 3.9.2-1 |
| apache | zookeeper | 3.6.0 – 3.7.2 | — |
| apache | zookeeper | >= 3.8.0 < 3.8.4 | 3.8.4 |
| apache | zookeeper | >= 3.9.0 < 3.9.2 | 3.9.2 |
| apache_software_foundation | apache_zookeeper | 3.6.0 – 3.7.2 | — |
| apache_software_foundation | apache_zookeeper | 3.8.0 – 3.8.3 | — |
| apache_software_foundation | apache_zookeeper | 3.9.0 – 3.9.1 | — |
| debian | zookeeper | < zookeeper 3.8.0-11+deb12u2 (bookworm) | zookeeper 3.8.0-11+deb12u2 (bookworm) |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_oracle5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Apache ZooKeeper vulnerable to information disclosure in persistent watchers handling
osv·2024-03-15
CVE-2024-23944 [MEDIUM] Apache ZooKeeper vulnerable to information disclosure in persistent watchers handling
Apache ZooKeeper vulnerable to information disclosure in persistent watchers handling
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade to
OSV
CVE-2024-23944: Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check
osv·2024-03-15·CVSS 5.3
CVE-2024-23944 [MEDIUM] CVE-2024-23944: Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Users are recommended to upgrade to version 3.9.2, 3.8.4 which fixes the issue.
GHSA
Apache ZooKeeper vulnerable to information disclosure in persistent watchers handling
ghsa·2024-03-15
CVE-2024-23944 [MEDIUM] CWE-200 Apache ZooKeeper vulnerable to information disclosure in persistent watchers handling
Apache ZooKeeper vulnerable to information disclosure in persistent watchers handling
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade to
Oracle
Oracle Oracle GoldenGate Risk Matrix: Spark (Apache ZooKeeper) — CVE-2024-23944
vendor_oracle·2024-10-15·CVSS 5.3
CVE-2024-23944 [MEDIUM] Oracle Oracle GoldenGate Risk Matrix: Spark (Apache ZooKeeper) — CVE-2024-23944
Oracle Oracle GoldenGate Risk Matrix: Spark (Apache ZooKeeper) vulnerability
CVE: CVE-2024-23944
CVSS: 5.3
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2024 (OCT 2024)
Oracle
Oracle Oracle Construction and Engineering Risk Matrix: Document Management (Apache ZooKeeper) — CVE-2024-23944
vendor_oracle·2024-07-15·CVSS 3.1
CVE-2024-23944 [MEDIUM] Oracle Oracle Construction and Engineering Risk Matrix: Document Management (Apache ZooKeeper) — CVE-2024-23944
Oracle Oracle Construction and Engineering Risk Matrix: Document Management (Apache ZooKeeper) vulnerability
CVE: CVE-2024-23944
CVSS: 3.1
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujul2024 (JUL 2024)
Red Hat
Apache-ZooKeeper: Apache ZooKeeper: Information disclosure in persistent watcher handling
vendor_redhat·2024-03-15·CVSS 5.3
CVE-2024-23944 [MEDIUM] CWE-200 Apache-ZooKeeper: Apache ZooKeeper: Information disclosure in persistent watcher handling
Apache-ZooKeeper: Apache ZooKeeper: Information disclosure in persistent watcher handling
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade
Debian
CVE-2024-23944: zookeeper - Information disclosure in persistent watchers handling in Apache ZooKeeper due t...
vendor_debian·2024·CVSS 5.3
CVE-2024-23944 [MEDIUM] CVE-2024-23944: zookeeper - Information disclosure in persistent watchers handling in Apache ZooKeeper due t...
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Users are recommended to upgrade to version 3.9.2, 3.8.4 which fixes the issue.
Scope: local
bookworm: resolved (fixed in 3.
No detection rules found.
No public exploits indexed.
2024-03-15
Published