vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2019-0201

MEDIUM
5.9
CVSS Score
Published: May 23, 2019 at 01:42 PM UTC
Updated: June 17, 2026 at 02:07 AM UTC
11 products affected across 5 vendorsDebian LinuxFuseElement Software

Using Apache ZooKeeper by Apache Software Foundation?

Get instant alerts when new vulnerabilities affect Apache ZooKeeper - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM5.9
Exploit prediction
EPSS 10%

Description

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

ActiveMQ· Apachemaven
95%
5.15.9
Drill· Apachemaven
95%
1.16.0
Zookeeper· Apachemaven
95%
1.0.0 ≤ v ≤ 3.4.133.5.0-alpha ≤ v ≤ 3.5.4-beta3.5.03.5.0 alpha3.5.0 rc03.5.13.5.1 alpha3.5.1 rc03.5.1 rc13.5.1 rc23.5.1 rc33.5.1 rc43.5.23.5.2 alpha3.5.2 rc03.5.2 rc13.5.33.5.3 beta3.5.3 rc03.5.3 rc13.5.4 beta
Debian Linux· Debiandrupal
95%
8.09.0
Element Software· NetApp
95%
All versions
Hci Bootstrap OS· NetApp
95%
All versions
netapp-hci-compute-node (environment)
Goldengate Stream Analytics· Oracle
95%
v < 19.1.0.0.1
Affected range stops below 19.1.0.0.1, so it looks safe — our inference, not a vendor statement
Siebel Core - Server Framework· Oracle
95%
v ≤ 21.5
Timesten in Memory Database· Oracle
95%
v < 18.1.3.1.0
Affected range stops below 18.1.3.1.0, so it looks safe — our inference, not a vendor statement
Fuse· Red Hatrpm
95%
1.0.0

References (20)

VDB Entryx_refsource_BIDThird Party Advisory
Source: [email protected]
http://www.securityfocus.com/bid/108427
Vendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2019:3140
Vendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2019:3892
Vendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2019:4352
x_refsource_MISCIssue TrackingPatchVendor Advisory
Source: [email protected]
https://issues.apache.org/jira/browse/ZOOKEEPER-1392
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/5d9a1cf41a5880557bf680b7321b4ab9a4d206c601ffb15fef6f196a%40%3Ccommits.accumulo.apache.org%3E

CVSS

5.9MEDIUM[email protected]
Attack Vector
NETWORK
Complexity
HIGH
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-862

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card