A flaw was found in the Kroxylicious ACL authorizer.
A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Red Hat
- Product
- streams for Apache Kafka 2, streams for Apache Kafka 3
- CVSS v3.1
- 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-863
- Exposure class
- Database
- NVD status
- Awaiting Analysis
Why it ranks 14 (Routine)
- CVSS v3.1 6.5 medium
- Product class: database
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.