CVE-2018-1288

MEDIUM

Apache Kafka <1.0.0 - Privilege Escalation

Title source: llm
STIX 2.1

Description

In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.

References (10)

Core 10
Core References
Broken Link vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/104900
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:3768
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujul2020.html

Scores

CVSS v3 5.4
EPSS 0.0069
EPSS Percentile 72.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Details

Status published
Products (11)
apache/kafka 1.0.0
apache/kafka 0.9.0.0 - 0.9.0.1
oracle/database 11.2.0.4
oracle/database 12.1.0.2
oracle/database 12.2.0.1
oracle/database 18c
oracle/database 19c
oracle/primavera_p6_enterprise_project_portfolio_management 19.12.0.0 - 19.12.6.0
oracle/timesten_in-memory_database < 18.1.2.1.0
org.apache.kafka/kafka 0.9.0.0 - 0.10.2.2Maven
... and 1 more
Published Jul 26, 2018
Tracked Since Feb 18, 2026