{"schemaVersion":3,"id":"CVE-2024-31141","aliases":["CGA-229f-hvm5-5vrh","CGA-2545-vg46-q42f","CGA-2f46-46mw-5xvv","CGA-2q3v-87v9-mc7m","CGA-3cp9-vhm9-9c42","CGA-4p28-h9f5-w4vr","CGA-55jf-xc3x-phhx","CGA-5vw3-96j2-2qrr","CGA-67m7-6v44-q55w","CGA-6m89-j83q-pxr9","CGA-6pjh-p9m9-8q8x","CGA-6qh9-2r2v-w442","CGA-826w-cqfw-9mhw","CGA-8298-h479-rx3f","CGA-842f-x736-vgx6","CGA-9264-9q77-vw74","CGA-95j4-rg62-58v4","CGA-9p99-7rvw-6fg3","CGA-cg65-hwj6-4gm6","CGA-ch3v-fhcr-rm55","CGA-cpjm-r862-qpmf","CGA-fcmx-2348-c23c","CGA-fxv6-39mx-fv3c","CGA-gcp8-w6q8-wf3v","CGA-gjw2-wp26-w4mw","CGA-gr7m-rwgj-j879","CGA-h336-xprr-xjxr","CGA-h8p5-hcxg-v8qg","CGA-hcpc-97xm-3mgc","CGA-hjj7-24gj-c256","CGA-j9hm-jrgv-25w4","CGA-jc7w-gpp3-86hv","CGA-mp67-94w2-gcc8","CGA-mw6f-rw7f-33f2","CGA-pwvr-q2xf-68qh","CGA-qh66-grp5-73q8","CGA-qmj9-5jp4-fg22","CGA-r3hf-q9pc-77gg","CGA-r95c-282h-pfjp","CGA-rg44-fcxx-6jhr","CGA-rvqj-6rw4-j2x9","CGA-rwg4-mxm9-9fr5","CGA-v242-j59h-fv3m","CGA-v5pc-6jh6-cg7c","CGA-v99j-2h9q-77r8","CGA-w375-2cvr-rp98","CGA-w433-vfjp-6fp4","CGA-w872-8g65-q2vp","CGA-fxf5-rvq9-cc3r","CGA-hpc7-pm7x-cprw","GHSA-2x2g-32r7-p4x8"],"status":"published","duplicateOf":null,"title":null,"description":"Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients.\n\nApache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables.\nIn applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables.\n\nIn particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products.\nThis issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0.\n\n\nUsers with affected applications are recommended to upgrade kafka-clients to version >=3.8.0, and set the JVM system property \"org.apache.kafka.automatic.config.providers=none\".\nUsers of Kafka Connect with one of the listed ConfigProvider implementations specified in their worker config are also recommended to add appropriate \"allowlist.pattern\" and \"allowed.paths\" to restrict their operation to appropriate bounds.\n\n\nFor users of Kafka Clients or Kafka Connect in environments that trust users with disk and environment variable access, it is not recommended to set the system property.\nFor users of the Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams, and Kafka command-line tools, it is not recommended to set the system property.","dates":{"published":"2024-11-19T08:40:50.695Z","modified":"2025-01-31T15:02:44.982Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.5,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":7.2,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":7.2,"impact":6,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Maven","score":6.8,"severity":"medium","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":7.2,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.0124,"percentile":0.68681,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.0124},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0124,"percentile":0.68681}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0124,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0124,"percentile":0.68681}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-269","name":"Improper Privilege Management","description":"The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/269.html"},{"id":"CWE-552","name":"Files or Directories Accessible to External Parties","description":"The product makes files or directories accessible to unauthorized actors, even though they should not be.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/552.html"}],"affected":[{"vendor":"apache software foundation","product":"apache kafka clients","name":"Apache Kafka Clients","label":"apache kafka clients","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.3.0, ≤ 3.5.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.6.0, ≤ 3.6.2","noFixRecorded":false,"fixedIn":null},{"text":"3.7.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.3.0, ≤ 3.5.2 | ≥ 3.6.0, ≤ 3.6.2 | 3.7.0","eol":null,"hubHref":"/vendor/apache_software_foundation/apache_kafka_clients"},{"vendor":"apache","product":"kafka","name":"kafka","label":"kafka","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.3.0, ≤ 3.5.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.6.0, ≤ 3.6.2","noFixRecorded":false,"fixedIn":null},{"text":"3.7.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.3.0, ≤ 3.5.2 | ≥ 3.6.0, ≤ 3.6.2 | 3.7.0","eol":{"isEol":true,"eolDate":"2024-07-26T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"3.7","label":"3.7","eolFrom":"2024-07-26T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"3.7.2"},"product":{"name":"apache-kafka","label":"Apache Kafka","category":"server-app"}},"hubHref":"/vendor/apache/kafka"},{"vendor":"chainguard","product":"apache-nifi","name":"apache-nifi","label":"apache-nifi","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-nifi","purlType":"apk","versions":[{"text":"< 2.0.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apache-nifi-compat","name":"apache-nifi-compat","label":"apache-nifi-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-nifi-compat","purlType":"apk","versions":[{"text":"< 2.0.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apache-nifi-toolkit","name":"apache-nifi-toolkit","label":"apache-nifi-toolkit","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-nifi-toolkit","purlType":"apk","versions":[{"text":"< 2.0.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"druid","name":"druid","label":"druid","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/druid","purlType":"apk","versions":[{"text":"< 31.0.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 31.0.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"druid-compat","name":"druid-compat","label":"druid-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/druid-compat","purlType":"apk","versions":[{"text":"< 31.0.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 31.0.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"hadoop-fips-3.3.6","name":"hadoop-fips-3.3.6","label":"hadoop-fips-3.3.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/hadoop-fips-3.3.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kafka_exporter-strimzi-compat","name":"kafka_exporter-strimzi-compat","label":"kafka_exporter-strimzi-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kafka_exporter-strimzi-compat","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kafka-strimzi-compat","name":"kafka-strimzi-compat","label":"kafka-strimzi-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kafka-strimzi-compat","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"logstash-8-with-output-opensearch","name":"logstash-8-with-output-opensearch","label":"logstash-8-with-output-opensearch","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/logstash-8-with-output-opensearch","purlType":"apk","versions":[{"text":"< 8.16.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.16.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"prometheus-jmx-exporter-strimzi-compat","name":"prometheus-jmx-exporter-strimzi-compat","label":"prometheus-jmx-exporter-strimzi-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/prometheus-jmx-exporter-strimzi-compat","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"strimzi-kafka-operator","name":"strimzi-kafka-operator","label":"strimzi-kafka-operator","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/strimzi-kafka-operator","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"strimzi-kafka-operator-cluster-operator","name":"strimzi-kafka-operator-cluster-operator","label":"strimzi-kafka-operator-cluster-operator","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/strimzi-kafka-operator-cluster-operator","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"strimzi-kafka-operator-kafka-agent","name":"strimzi-kafka-operator-kafka-agent","label":"strimzi-kafka-operator-kafka-agent","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/strimzi-kafka-operator-kafka-agent","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"strimzi-kafka-operator-kafka-base","name":"strimzi-kafka-operator-kafka-base","label":"strimzi-kafka-operator-kafka-base","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/strimzi-kafka-operator-kafka-base","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"strimzi-kafka-operator-kafka-init","name":"strimzi-kafka-operator-kafka-init","label":"strimzi-kafka-operator-kafka-init","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/strimzi-kafka-operator-kafka-init","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"strimzi-kafka-operator-kafka-thirdparty-libs","name":"strimzi-kafka-operator-kafka-thirdparty-libs","label":"strimzi-kafka-operator-kafka-thirdparty-libs","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/strimzi-kafka-operator-kafka-thirdparty-libs","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"strimzi-kafka-operator-kafka-thirdparty-libs-cc","name":"strimzi-kafka-operator-kafka-thirdparty-libs-cc","label":"strimzi-kafka-operator-kafka-thirdparty-libs-cc","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/strimzi-kafka-operator-kafka-thirdparty-libs-cc","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"strimzi-kafka-operator-topic-operator","name":"strimzi-kafka-operator-topic-operator","label":"strimzi-kafka-operator-topic-operator","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/strimzi-kafka-operator-topic-operator","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"strimzi-kafka-operator-tracing-agent","name":"strimzi-kafka-operator-tracing-agent","label":"strimzi-kafka-operator-tracing-agent","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/strimzi-kafka-operator-tracing-agent","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"strimzi-kafka-operator-user-operator","name":"strimzi-kafka-operator-user-operator","label":"strimzi-kafka-operator-user-operator","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/strimzi-kafka-operator-user-operator","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard","name":"thingsboard","label":"thingsboard","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard","purlType":"apk","versions":[{"text":"< 3.8.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.1-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-js-executor","name":"thingsboard-tb-js-executor","label":"thingsboard-tb-js-executor","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-js-executor","purlType":"apk","versions":[{"text":"< 3.8.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.1-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-mqtt-transport","name":"thingsboard-tb-mqtt-transport","label":"thingsboard-tb-mqtt-transport","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-mqtt-transport","purlType":"apk","versions":[{"text":"< 3.8.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.1-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-node","name":"thingsboard-tb-node","label":"thingsboard-tb-node","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-node","purlType":"apk","versions":[{"text":"< 3.8.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.1-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-web-ui","name":"thingsboard-tb-web-ui","label":"thingsboard-tb-web-ui","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-web-ui","purlType":"apk","versions":[{"text":"< 3.8.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.1-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apache-nifi","name":"apache-nifi","label":"apache-nifi","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apache-nifi","purlType":"apk","versions":[{"text":"< 2.0.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.0-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apache-nifi-compat","name":"apache-nifi-compat","label":"apache-nifi-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apache-nifi-compat","purlType":"apk","versions":[{"text":"< 2.0.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.0-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apache-nifi-toolkit","name":"apache-nifi-toolkit","label":"apache-nifi-toolkit","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apache-nifi-toolkit","purlType":"apk","versions":[{"text":"< 2.0.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.0-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"druid","name":"druid","label":"druid","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/druid","purlType":"apk","versions":[{"text":"< 31.0.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 31.0.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"druid-compat","name":"druid-compat","label":"druid-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/druid-compat","purlType":"apk","versions":[{"text":"< 31.0.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 31.0.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kafka_exporter-strimzi-compat","name":"kafka_exporter-strimzi-compat","label":"kafka_exporter-strimzi-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kafka_exporter-strimzi-compat","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kafka-strimzi-compat","name":"kafka-strimzi-compat","label":"kafka-strimzi-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kafka-strimzi-compat","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"logstash-8-with-output-opensearch","name":"logstash-8-with-output-opensearch","label":"logstash-8-with-output-opensearch","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/logstash-8-with-output-opensearch","purlType":"apk","versions":[{"text":"< 8.16.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.16.1-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"prometheus-jmx-exporter-strimzi-compat","name":"prometheus-jmx-exporter-strimzi-compat","label":"prometheus-jmx-exporter-strimzi-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/prometheus-jmx-exporter-strimzi-compat","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"strimzi-kafka-operator","name":"strimzi-kafka-operator","label":"strimzi-kafka-operator","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/strimzi-kafka-operator","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"strimzi-kafka-operator-cluster-operator","name":"strimzi-kafka-operator-cluster-operator","label":"strimzi-kafka-operator-cluster-operator","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/strimzi-kafka-operator-cluster-operator","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"strimzi-kafka-operator-kafka-agent","name":"strimzi-kafka-operator-kafka-agent","label":"strimzi-kafka-operator-kafka-agent","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/strimzi-kafka-operator-kafka-agent","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"strimzi-kafka-operator-kafka-base","name":"strimzi-kafka-operator-kafka-base","label":"strimzi-kafka-operator-kafka-base","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/strimzi-kafka-operator-kafka-base","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"strimzi-kafka-operator-kafka-init","name":"strimzi-kafka-operator-kafka-init","label":"strimzi-kafka-operator-kafka-init","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/strimzi-kafka-operator-kafka-init","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"strimzi-kafka-operator-kafka-thirdparty-libs","name":"strimzi-kafka-operator-kafka-thirdparty-libs","label":"strimzi-kafka-operator-kafka-thirdparty-libs","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/strimzi-kafka-operator-kafka-thirdparty-libs","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"strimzi-kafka-operator-kafka-thirdparty-libs-cc","name":"strimzi-kafka-operator-kafka-thirdparty-libs-cc","label":"strimzi-kafka-operator-kafka-thirdparty-libs-cc","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/strimzi-kafka-operator-kafka-thirdparty-libs-cc","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"strimzi-kafka-operator-topic-operator","name":"strimzi-kafka-operator-topic-operator","label":"strimzi-kafka-operator-topic-operator","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/strimzi-kafka-operator-topic-operator","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"strimzi-kafka-operator-tracing-agent","name":"strimzi-kafka-operator-tracing-agent","label":"strimzi-kafka-operator-tracing-agent","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/strimzi-kafka-operator-tracing-agent","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"strimzi-kafka-operator-user-operator","name":"strimzi-kafka-operator-user-operator","label":"strimzi-kafka-operator-user-operator","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/strimzi-kafka-operator-user-operator","purlType":"apk","versions":[{"text":"< 0.44.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard","name":"thingsboard","label":"thingsboard","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard","purlType":"apk","versions":[{"text":"< 3.8.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.1-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard-tb-js-executor","name":"thingsboard-tb-js-executor","label":"thingsboard-tb-js-executor","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard-tb-js-executor","purlType":"apk","versions":[{"text":"< 3.8.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.1-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard-tb-mqtt-transport","name":"thingsboard-tb-mqtt-transport","label":"thingsboard-tb-mqtt-transport","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard-tb-mqtt-transport","purlType":"apk","versions":[{"text":"< 3.8.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.1-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard-tb-node","name":"thingsboard-tb-node","label":"thingsboard-tb-node","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard-tb-node","purlType":"apk","versions":[{"text":"< 3.8.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.1-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard-tb-web-ui","name":"thingsboard-tb-web-ui","label":"thingsboard-tb-web-ui","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard-tb-web-ui","purlType":"apk","versions":[{"text":"< 3.8.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.1-r4","eol":null,"hubHref":null},{"vendor":"org.apache.kafka","product":"kafka-clients","name":"org.apache.kafka:kafka-clients","label":"kafka-clients","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.apache.kafka/kafka-clients","purlType":"maven","versions":[{"text":"≥ 2.3.0, < 3.7.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.3.0, < 3.7.1","eol":null,"hubHref":null}],"affectedCount":52,"eol":{"hasEol":true,"count":1},"references":[{"url":"https://lists.apache.org/thread/9whdzfr0zwdhr364604w5ssnzmg4v2lv","label":"lists.apache.org/thread/9whdzfr0zwdhr364604w5ssnzmg4v2lv","hostname":"lists.apache.org","tags":["Vendor Advisory","Advisory","WEB","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2024/11/18/5","label":"www.openwall.com/lists/oss-security/2024/11/18/5","hostname":"www.openwall.com","tags":["WEB","Mailing List","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20250131-0001/","label":"security.netapp.com/advisory/ntap-20250131-0001/","hostname":"security.netapp.com","tags":["Advisory","Third Party Advisory"]},{"url":"https://repo.maven.apache.org/maven2","label":"repo.maven.apache.org/maven2","hostname":"repo.maven.apache.org","tags":["WEB"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31141.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31141.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31141","label":"nvd.nist.gov/vuln/detail/CVE-2024-31141","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/apache/kafka","label":"github.com/apache/kafka","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://security.netapp.com/advisory/ntap-20250131-0001","label":"security.netapp.com/advisory/ntap-20250131-0001","hostname":"security.netapp.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-5HWV-4V3Q-5782","CGA-CQH5-2339-79W3","CGA-PF58-92F9-Q6FC","CGA-RVRR-V82M-F394"]},"timeline":[{"kind":"published","date":"2024-11-19T08:40:50.695Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-01-31T15:02:44.982Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":26,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T02:17:41.771Z","stale":false,"partial":false}}