5.3

CVE-2024-23944: apache software foundation apache zookeeper Missing Authorization

CVSS: 5.3v3.1MediumModified
AliasesUBUNTU-CVE-2024-23944DEBIAN-CVE-2024-23944CGA-23g6-h3m9-h344
Published 15-03-2024Last modified 03-07-2025
Open JSON

Vulnerability summary

CVE-2024-23944 is a medium (CVSS 5.3) Missing Authorization vulnerability in apache software foundation apache zookeeper. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 14.8% of scored vulnerabilities.

Overall risk
21/100
0100
Low · default modelHow is this calculated?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.25%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 6
CGA-7X45-JMMJ-P4H3CGA-H562-6HP9-9X2QCGA-MRR6-55FR-72MHCGA-PXQ6-3GJC-M265CGA-RGR4-3VCX-CJ8XCGA-WVCW-6W45-H72M

Timeline

  1. 15-03-2024
    PublishedVulnerability first disclosed.
  2. 03-07-2025
    Last modifiedVulnerability information updated.

Description

Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Users are recommended to upgrade to version 3.9.2, 3.8.4 which fixes the issue.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.25%

Chance of exploitation in the next 30 days

Percentile

15%

Versus all other CVEs

30-day change

0.00 pp

From 0.25% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard66 products
  • confluent-common-docker< 7.6.9-r0
  • confluent-kafka< 8.2.0.367-r0
  • hadoop-fips-3.3.6All versions (No fix recorded)
  • hadoop-fips-3.4.2All versions (No fix recorded)
  • solr< 9.5.0-r2
Wolfi63 products
  • confluent-common-docker< 7.6.9-r0
  • confluent-kafka< 8.2.0.367-r0
  • solr< 9.5.0-r2
  • tez< 0.10.4-r6
  • trino< 443-r0
Apache1 product
  • zookeeper≥ 3.6.0, ≤ 3.7.2 | ≥ 3.8.0, < 3.8.4 | ≥ 3.9.0, < 3.9.2
Apache software foundation1 product
  • apache zookeeper≥ 3.9.0, ≤ 3.9.1 | ≥ 3.8.0, ≤ 3.8.3 | ≥ 3.6.0, ≤ 3.7.2
Debian1 product
  • zookeeper< 3.8.0-11+deb12u2 | < 3.9.2-1
Org.apache.zookeeper1 product
  • zookeeper≥ 3.8.0, < 3.8.4 | ≥ 3.9.0, < 3.9.2 | ≥ 3.6.0, ≤ 3.7.2
Ubuntu1 product
  • zookeeperAll versions (No fix recorded)

7 vendors · 134 products

References

13 links
Show all 13 references