8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
42.0%
Apache Kafka is vulnerable to improper input validation that could allow remote attacker to bypass security restrictions.
CVEID:CVE-2018-17196
**DESCRIPTION:**Apache Kafka could allow a remote authenticated attacker to bypass security restrictions, caused by improper input validation. By sending a specially-crafted Produce request, an attacker could exploit this vulnerability to bypass transaction/idempotent ACL validation.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/163622 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Affected Product(s) | Version(s) |
---|---|
Log Analysis | 1.3.5.3 |
Log Analysis | 1.3.6.0 |
Log Analysis | 1.3.6.1 |
Log Analysis | 1.3.7.0 |
Log Analysis | 1.3.7.1 |
Log Analysis | 1.3.7.2 |
Version | Fix details |
---|---|
IBM Operations Analytics - Log Analysis version 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2 | Upgrade to Log Analysis version 1.3.7.2 Interim Fix 3. Download the 1.3.7.2-TIV-IOALA-IF003 and apply fix on Logstash installation. |
None
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
42.0%