{"answers":{"affected":"7 open source packages ship an affected version, including org.apache.zookeeper:zookeeper and zookeeper. It affects 1 product.","exploited":"There is no known exploitation of CVE-2024-23944 in the wild and no public exploit code.","fix":"Upgrade org.apache.zookeeper:zookeeper to a fixed version for your release line: 3.8.4 or 3.9.2.","what":"CVE-2024-23944 is a medium-severity missing authorization vulnerability in Apache ZooKeeper, published on 15 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-23944 and fix it if it is affected.\n\nWhat it is: CVE-2024-23944 is a medium-severity missing authorization vulnerability in Apache ZooKeeper, published on 15 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-23944 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- org.apache.zookeeper:zookeeper (Maven): affected from 3.6.0 up to 3.7.2; no fix listed\n- org.apache.zookeeper:zookeeper (Maven): affected from 3.6.0 up to 3.7.2; no fix listed\n- org.apache.zookeeper:zookeeper (Maven): affected from 3.8.0; fixed in 3.8.4\n- org.apache.zookeeper:zookeeper (Maven): affected from 3.8.0; fixed in 3.8.4\n- org.apache.zookeeper:zookeeper (Maven): affected from 3.9.0; fixed in 3.9.2\n- org.apache.zookeeper:zookeeper (Maven): affected from 3.9.0; fixed in 3.9.2\n- zookeeper (Bitnami): affected from 3.6.0; fixed in 3.8.4, 3.9.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-23944/ (Markdown: https://insights.sbomify.com/CVE-2024-23944/index.md)","id":"CVE-2024-23944","markdown":"https://insights.sbomify.com/CVE-2024-23944/index.md","name":"CVE-2024-23944","record":{"aliases":["BIT-zookeeper-2024-23944","CLEANSTART-2026-YW96996","DEBIAN-CVE-2024-23944","ECHO-0e1c-8839-7f9b","GHSA-r978-9m6m-6gm6","MINI-48vw-6g2m-74f4","MINI-8qhj-4vcx-x6f6","MINI-wrw4-qx93-q9xx","UBUNTU-CVE-2024-23944"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Distributed coordination service","requires_auth":"low_privilege","summary":"Attackers can monitor child znodes and expose sensitive path information via persistent watchers due to missing ACL checks in Apache ZooKeeper.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"apache","cpe":[{"product":"zookeeper","vendor":"apache"}],"cvss":{"score":5.3,"severity":"medium","source":"cisa-adp","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"cwes":[{"id":"CWE-862","name":"Missing Authorization"}],"description":"Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.\n\nUsers are recommended to upgrade to version 3.9.2, 3.8.4 which fixes the issue.","ecosystems":["Bitnami","Maven"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Apache ZooKeeper: Information disclosure in persistent watcher handling","id":"CVE-2024-23944","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Bitnami","product":null,"products":[],"type":"missing_authorization","year":"2024"},"n_packages":7,"n_references":1,"next":{"headline":"Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails","id":"CVE-2024-23945"},"packages":[{"ecosystem":"Bitnami","fixed":["3.8.4","3.9.2"],"introduced":["3.6.0","3.9.0"],"last_affected":[],"package":"zookeeper","purl":"pkg:bitnami/zookeeper","source":"BIT-zookeeper-2024-23944"},{"ecosystem":"Maven","fixed":[],"introduced":["3.6.0"],"last_affected":["3.7.2"],"package":"org.apache.zookeeper:zookeeper","purl":null,"source":"GHSA-r978-9m6m-6gm6"},{"ecosystem":"Maven","fixed":[],"introduced":["3.6.0"],"last_affected":["3.7.2"],"package":"org.apache.zookeeper:zookeeper","purl":"pkg:maven/org.apache.zookeeper/zookeeper","source":"GHSA-r978-9m6m-6gm6"},{"ecosystem":"Maven","fixed":["3.8.4"],"introduced":["3.8.0"],"last_affected":[],"package":"org.apache.zookeeper:zookeeper","purl":null,"source":"GHSA-r978-9m6m-6gm6"},{"ecosystem":"Maven","fixed":["3.8.4"],"introduced":["3.8.0"],"last_affected":[],"package":"org.apache.zookeeper:zookeeper","purl":"pkg:maven/org.apache.zookeeper/zookeeper","source":"GHSA-r978-9m6m-6gm6"},{"ecosystem":"Maven","fixed":["3.9.2"],"introduced":["3.9.0"],"last_affected":[],"package":"org.apache.zookeeper:zookeeper","purl":null,"source":"GHSA-r978-9m6m-6gm6"},{"ecosystem":"Maven","fixed":["3.9.2"],"introduced":["3.9.0"],"last_affected":[],"package":"org.apache.zookeeper:zookeeper","purl":"pkg:maven/org.apache.zookeeper/zookeeper","source":"GHSA-r978-9m6m-6gm6"}],"prev":{"headline":"MB connect line: Cloud API access due to a lack of authentication for a critical function","id":"CVE-2024-23943"},"products":["Apache ZooKeeper"],"published":"2024-03-15","related":[{"cvss_score":9.1,"headline":"Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server","id":"CVE-2024-51504","kev_date_added":null,"published":"2024-11-07"},{"cvss_score":9.1,"headline":"Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication","id":"CVE-2023-44981","kev_date_added":null,"published":"2023-10-11"},{"cvss_score":8.1,"headline":"Memory corruption in n/a","id":"CVE-2016-5017","kev_date_added":null,"published":"2016-09-21"},{"cvss_score":7.5,"headline":"Apache ZooKeeper: Information disclosure via SetWatches reconnect replay","id":"CVE-2026-59739","kev_date_added":null,"published":"2026-09-16"},{"cvss_score":7.5,"headline":"Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode","id":"CVE-2026-59969","kev_date_added":null,"published":"2026-09-16"},{"cvss_score":7.5,"headline":"Missing authorization in Apache ZooKeeper","id":"CVE-2026-79993","kev_date_added":null,"published":"2026-09-16"},{"cvss_score":7.5,"headline":"Missing Authorization in Apache ZooKeeper","id":"CVE-2018-8012","kev_date_added":null,"published":"2018-05-21"}],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-07-03","vendors":["Apache Software Foundation"]},"summary":"Attackers can monitor child znodes and expose sensitive path information via persistent watchers due to missing ACL checks in Apache ZooKeeper.","url":"https://insights.sbomify.com/CVE-2024-23944/"}