CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-51504 – Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server
https://notcve.org/view.php?id=CVE-2024-51504
07 Nov 2024 — When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which uses HTTP request headers, is weak and allows an attacker to bypass authentication via spoofing client's IP address in request headers. Default configuration honors X-Forwarded-For HTTP header to read client's IP add... • https://lists.apache.org/thread/b3qrmpkto5r6989qr61fw9y2x646kqlh • CWE-290: Authentication Bypass by Spoofing •
CVSS: 6.6EPSS: 0%CPEs: 3EXPL: 0CVE-2024-23944 – Apache ZooKeeper: Information disclosure in persistent watcher handling
https://notcve.org/view.php?id=CVE-2024-23944
15 Mar 2024 — Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed b... • http://www.openwall.com/lists/oss-security/2024/03/14/2 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •