CVE-2024-31141

CWE-269 — Improper Privilege ManagementCWE-552 — Files Accessible to External PartiesCWE-737 documents6 sources
Severity
6.5MEDIUM
EPSS
0.2%
top 63.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache Kafka ClientsApache Kafka
Timeline
PublishedNov 19
Latest updateJul 15

Description

Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables. In applications where Apache Kafka Clien…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶Mavenorg.apache.kafka:kafka-clients2.3.0 — 3.7.1
▶NVDapache/kafka2.3.0 — 3.5.2+2

🔴Vulnerability Details

3
OSV
Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider↗2024-11-19
▶
CVEList
Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider↗2024-11-19
▶
GHSA
Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider↗2024-11-19
▶

📋Vendor Advisories

3
Oracle
Oracle Oracle Communications Applications Risk Matrix: Third Party (Apache Kafka) — CVE-2024-31141↗2025-07-15
▶
Oracle
Oracle Oracle Communications Applications Risk Matrix: Microservices (Apache Kafka) — CVE-2024-31141↗2025-04-15
▶
Red Hat
kafka-clients: privilege escalation to filesystem read-access via automatic ConfigProvider↗2024-11-19
▶
CVE-2024-31141 (MEDIUM CVSS 6.5) | Files or Directories Accessible to | cvebase.io