Information Disclosure

Apache ZooKeeper is affected by unauthorized information disclosure. getACL command does not check permissions when retrieving the ACLs of the requested node. Consequently, plaintext information contained in the ACL Id field is returned. This allows an attacker to retrieve users' Id and...