Medium severity · published May 23, 2019
CVE-2019-0201
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta
5.9
CVSS
9.7%
EPSS
No
On KEV
Description
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)9.7% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
ActiveMQ · Apache
5.15.9 · source: NVD
DL
Debian Linux · Debian
8.0; 9.0 · source: NVD
DR
Drill · Apache
1.16.0 · source: NVD
ES
Element Software · Netapp
All versions, or not specified · source: NVD
FU
Fuse · Redhat
1.0.0 · source: NVD
GS
Goldengate Stream Analytics · Oracle
before 19.1.0.0.1 · source: NVD
HB
Hci Bootstrap OS · Netapp
All versions, or not specified · source: NVD
SC
Siebel Core - Server Framework · Oracle
through 21.5 · source: NVD
TI
Timesten In-memory Database · Oracle
before 18.1.3.1.0 · source: NVD
ZO
Zookeeper · Apache
1.0.0 through 3.4.13; 3.5.0; 3.5.0; 3.5.0; 3.5.1; 3.5.1; +14 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0201
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0201
Third Party Advisory
http://www.securityfocus.com/bid/108427
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3140
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3892
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4352
Issue Tracking
https://issues.apache.org/jira/browse/ZOOKEEPER-1392
lists.apache.org
https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E
More from ActiveMQ
9.8
CVE-2023-46604
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
9.8
CVE-2016-3088
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request
8.8
CVE-2026-34197
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
9.9
CVE-2021-21345
XStream is vulnerable to a Remote Command Execution attack
9.8
CVE-2021-21350
XStream is vulnerable to an Arbitrary Code Execution attack