CVE Feed

    Dashboard / CVE / CVE-2018-1288

    CVE-2018-1288

    In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.

    Published:Jul 26, 2018
    Last Modified:Nov 21, 2024
    EPS:Jul 26, 2018
    EPSS Score:0.00932
    CVSS Score:5.4

    Affected Products

    Vendor
    Apache
    Product
    Kafka
    Vendor
    Oracle
    Product
    Database
    Vendor
    Oracle
    Product
    Primavera P6 Enterprise Project Portfolio Management
    Vendor
    Oracle
    Product
    Timesten In-memory Database
    Vendor
    Redhat
    Product
    Jboss Fuse
    Vendor
    Redhat
    Product
    Jboss Middleware Text-only Advisories

    Exploits

    https://github.com/joegallagher4/CVE-2018-1288-

    Common Weakness Enumeration

    CWE-287 Improper Authentication

    Related CVEs

    CVE-2026-41115 (CVSS 4.3) — An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUM…
    CVE-2026-33557 (CVSS 9.1) — A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.…
    CVE-2026-33558 (CVSS 5.3) — Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will outp…
    CVE-2026-35554 (CVSS 8.7) — A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be si…
    CVE-2025-27817 (CVSS 7.5) — A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka…
    CVE-2025-27819 (CVSS 7.5) — In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration i…
    CVE-2025-27818 (CVSS 8.8) — A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig t…
    CVE-2024-56128 (CVSS 5.3) — Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: A…
    CVE-2024-31141 (CVSS 6.5) — Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kaf…
    CVE-2024-27309 (CVSS 7.4) — While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not…

    References

    http://www.securityfocus.com/bid/104900
    https://access.redhat.com/errata/RHSA-2018:3768
    https://lists.apache.org/thread.html/29f61337323f48c47d4b41d74b9e452bd60e65d0e5103af9a6bb2fef%40%3Cusers.kafka.apache.org%3E
    https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/d1581fb6464c9bec8a72575c01f5097d68e2fbb230aff24622622a58%40%3Ccommits.kafka.apache.org%3E
    https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
    https://lists.apache.org/thread.html/r07e1bbd1643847d599feb34c707906a4fdcc81e3a6ab01a10c451d40%40%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/r35322aec467ddae34002690edaa4d9f16e7df9b5bf7164869b75b62c%40%3Cdev.kafka.apache.org%3E
    https://www.oracle.com/security-alerts/cpujul2020.html
    http://www.securityfocus.com/bid/104900
    https://access.redhat.com/errata/RHSA-2018:3768
    https://lists.apache.org/thread.html/29f61337323f48c47d4b41d74b9e452bd60e65d0e5103af9a6bb2fef%40%3Cusers.kafka.apache.org%3E
    https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
    https://lists.apache.org/thread.html/d1581fb6464c9bec8a72575c01f5097d68e2fbb230aff24622622a58%40%3Ccommits.kafka.apache.org%3E
    https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
    https://lists.apache.org/thread.html/r07e1bbd1643847d599feb34c707906a4fdcc81e3a6ab01a10c451d40%40%3Cissues.flink.apache.org%3E
    https://lists.apache.org/thread.html/r35322aec467ddae34002690edaa4d9f16e7df9b5bf7164869b75b62c%40%3Cdev.kafka.apache.org%3E
    https://www.oracle.com/security-alerts/cpujul2020.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High