CVE-2018-1288

Aliases:GHSA-gh27-38p5-mrxc
Advisory lineage Upstream: 0 Downstream: 3
Modified
Published: 26 Jul 2018, 14:00
Last modified:17 Sept 2024, 02:52

Vulnerability Summary

Overall Risk (default)
low
22/100
CVSS Score
5.5 MEDIUM
v2.0 (nvd)
EPSS Score
0.69% LOW
1% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

26 Jul 2018, 14:00
Published
Vulnerability first disclosed
17 Sept 2024, 02:52
Last Modified
Vulnerability information updated

Description

In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
  • v2.0•MEDIUM•Score: 5.5AV:N/AC:L/Au:S/C:N/I:P/A:P

EPSS Trends

Current EPSS score: 0.69%• Percentile: 72%

Affected Systems

  • apache software foundation•apache kafka

    0.9.0.0 to 0.9.0.1 | 0.10.0.0 to 0.10.2.1 | 0.11.0.0 to 0.11.0.2 | 1.0.0

  • apache•kafka

    > 0.9.0.0, ≤ 0.9.0.1 | ≥ 0.10.0.0, ≤ 0.10.2.1 | ≥ 0.11.0.0, ≤ 0.11.0.2 | 1.0.0

  • org.apache.kafka•kafka

    ≥ 0.9.0.0, < 0.10.2.2 | ≥ 0.11.0.0, < 0.11.0.3 | ≥ 1.0.0, < 1.0.1

  • oracle•database

    11.2.0.4 | 12.1.0.2 | 12.2.0.1 | 18c | 19c

  • oracle•primavera_p6_enterprise_project_portfolio_management

    ≥ 19.12.0.0, ≤ 19.12.6.0

  • oracle•timesten_in-memory_database

    < 18.1.2.1.0

  • redhat•jboss_middleware_text-only_advisories

    1.0

References (18)