GitHub Advisoryadvisory · Maven

GHSA-q2xx-f8r3-9mg5 STRIMZI incorrect access control

HIGH Published 2024-06-17 Modified 2024-07-05 Official page ↗
Aliases
CVE-2024-36543
Ecosystem
Maven
Packages
io.strimzi:strimzi
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-306, CWE-400
Reviewed
2024-06-18

Affected packages

• Maven io.strimzi:strimzi: <= 0.41.0 (no fix yet)

Description

Incorrect access control in the Kafka Connect REST API in the STRIMZI Project 0.41.0 and earlier allows an attacker to deny the service for Kafka Mirroring, potentially mirror the topics' content to his Kafka cluster via a malicious connector (bypassing Kafka ACL if it exists), and potentially steal Kafka SASL credentials, by querying the MirrorMaker Kafka REST API.

Related

Alias · CVE (1)

  • CVE-2024-36543 Incorrect access control in the Kafka Connect REST API in the STRIMZI Project 0.41.0 and earlier allows an attacker to deny the service for… vulnerability

Weakness · CWE (2)

  • CWE-306 Missing Authentication for Critical Functionality weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References