Missing Authentication

2024-06-1904:34:21

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

strimzi

authentication

kafka mirroring

access control lists

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.7

Confidence

High

JSON

io. strimzi, strimzi is vulnerable to Missing Authentication. The vulnerability is due to improper access control implementation in the Kafka Connect REST API within the STRIMZI Project. The vulnerability allows attackers to exploit the API to potentially deny service for Kafka Mirroring, mirror topics’ content to their own Kafka cluster using a malicious connector and bypass Kafka ACLs (Access Control Lists) due to a lack of authentication.