CVE-2018-17196

In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation

published July 11, 2019

CVSS
—
EPSS
5%
Percentile
92.7
In the wild
Unconfirmed
What it is

In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users should upgrade to 2.1.1 or later where this vulnerability has been fixed.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.05479 · 92.7th percentile
Published
2019-07-11T20:37Z
EPSS history
Timeline
  • 11 JUL 20:37Z
    In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation
    cvelistv5