Informazioni sul CVE-2024-51504
Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server
CWE ID: CWE-290
Base Score (CVSS): N/A
CVE: CVE-2024-51504
Descrizione: When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing — this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client’s IP address detection in IPAuthenticationProvider, which uses HTTP request headers, is weak and allows an attacker to bypass authentication via spoofing client’s IP address in request headers. Default configuration honors X-Forwarded-For HTTP header to read client’s IP address. X-Forwarded-For request header is mainly used by proxy servers to identify the client and can be easily spoofed by an attacker pretending that the request comes from a different IP address. Admin Server commands, such as snapshot and restore arbitrarily can be executed on successful exploitation which could potentially lead to information leakage or service availability issues. Users are recommended to upgrade to version 3.9.3, which fixes this issue.
Vettore di attacco
Punteggio CVSS
Il CVSS è un sistema di valutazione che misura la gravità di una vulnerabilità informatica considerando fattori come l’impatto potenziale, la probabilità di attacco e la facilità di esecuzione.
Riassunto: .
Dettaglio del Vettore
| Metrica | Valore | Significato | Descrizione |
|---|
Riferimenti esterni
Prodotti interessati
- Apache Software Foundation – Apache ZooKeeper
Relazioni con altri prodotti
Produttore:Apache Software Foundation
Prodotto: Apache ZooKeeper
Anno: 2024
CWE: CWE-290
CVSS: 0.0