Incorrect authorization in Apache Kafka - CVE-2024-27309

Vulnerability identifier: #VU95166

CSH Severity: Medium

CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-27309

CWE-ID: CWE-863

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information and modify data on the system.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can gain access to sensitive information and modify data on the system.

Apache Kafka
IBM Observability with Instana
IBM Tivoli Netcool/OMNIbus Integration – Transport Module Common Integration Library
Communications Service Catalog and Design
Siebel CRM Integration
AMQ Streams
Maximo Application Suite - IoT Component
Event Streams

Install updates from vendor's website.

Apache Kafka - update to 3.6.2
IBM Observability with Instana - update to 1.0.297
IBM Tivoli Netcool/OMNIbus Integration – Transport Module Common Integration Library - update to 40.0
AMQ Streams - update to 2.5.2
Maximo Application Suite - IoT Component - addressed in versions 8.7.12, 8.8.8
Event Streams - update to 11.4.0

• https://lists.apache.org/thread/6536rmzyg076lzzdw2xdktvnz163mjpy
• http://www.openwall.com/lists/oss-security/2024/04/12/3
• https://security.netapp.com/advisory/ntap-20240705-0002/

• Incorrect authorization in Apache Kafka
• Incorrect authorization in IBM Maximo Application Suite - IoT Component
• Incorrect authorization in Event Streams
• Incorrect authorization in IBM Tivoli Netcool/OMNIbus Integration – Transport Module Common Integration Library
• Multiple vulnerabilities in AMQ Streams 2.5
• Multiple vulnerabilities in Communications Service Catalog and Design
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• Multiple vulnerabilities in Siebel CRM Integration