Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-27292 State: PUBLISHED Published: 2024-02-29T21:56:39.897Z Last Updated: 2024-08-02T19:27:42.423Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: jhpyle Products: docassemble Problem Types: CWE-706 Description: Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version 1.4.97 of the master branch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jhpyle/docassemble/secu
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jhpyle/docassemble/security/advisories/GHSA-jq57-3w7p-vwvv - https://github.com/jhpyle/docassemble/commit/97f77dc486a26a22ba804765bfd7058aabd600c9
CVE ID: CVE-2024-27294 State: PUBLISHED Published: 2024-02-29T22:47:05.535Z Last Updated: 2024-08-08T19:56:17.827Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: danielparks Products: puppet-golang Problem Types: CWE-732 Description: dp-golang is a Puppet module for Go installations. Prior to 1.2.7, dp-golang could install files — including the compiler binary — with the wrong ownership when Puppet was run as root and the installed package was On macOS: Go version 1.4.3 through 1.21rc3, inclusive, go1.4-bootstrap-20170518.tar.gz, or go1.4-bootstrap-20170531.tar.gz. The user and group specified in Puppet code were ignored for files within the archive. dp-puppe
otstrap-20170531.tar.gz. The user and group specified in Puppet code were ignored for files within the archive. dp-puppet version 1.2.7 will recreate installations if the owner or group of any file or directory within that installation does not match the requested owner or group Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/danielparks/puppet-golang/security/advisories/GHSA-8h8m-h98f-vv84 - https://github.com/danielparks/puppet-golang/commit/1d0865b24071cb1c00d2fd8cb755d444e6e8f888 - https://github.com/danielparks/puppet-golang/commit/870724a7fef50208515da7bbfa9dfd5d6950e7f5
CVE ID: CVE-2024-27295 State: PUBLISHED Published: 2024-03-01T15:37:09.617Z Last Updated: 2024-08-28T16:24:04.094Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: directus Products: directus Problem Types: CWE-706 Description: Directus is a real-time API and App dashboard for managing SQL database content. The password reset mechanism of the Directus backend allows attackers to receive a password reset email of a victim user, specifically having it arrive at a similar email address as the victim with a one or more characters changed to use accents. This is due to the fact that by default MySQL/MariaDB are configured for accent-insensitive and case-insensitive
cents. This is due to the fact that by default MySQL/MariaDB are configured for accent-insensitive and case-insensitive comparisons. This vulnerability is fixed in version 10.8.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/directus/directus/security/advisories/GHSA-qw9g-7549-7wg5
CVE ID: CVE-2024-27296 State: PUBLISHED Published: 2024-03-01T15:43:33.601Z Last Updated: 2024-08-08T18:38:46.653Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: directus Products: directus Problem Types: CWE-200 Description: Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number was being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version. The problem has been resolved in versio
rectus core or any of its shipped dependencies in that specific running version. The problem has been resolved in versions 10.8.3 and newer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/directus/directus/security/advisories/GHSA-5mhg-wv8w-p59j - https://github.com/directus/directus/commit/a5a1c26ac48795ed3212a4c51b9523588aff4fa0
CVE ID: CVE-2024-27297 State: PUBLISHED Published: 2024-03-11T21:24:43.919Z Last Updated: 2025-06-27T12:16:28.799Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) Vendors: NixOS Products: nix Problem Types: CWE-367 Description: Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as "valid" and immutable in the Nix database. In particular, this allows the output of
fter Nix has registered the path as "valid" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/NixOS/nix/security/advisories/GHSA-2ffj-w4mj-pg37 - https://github.com/NixOS/nix/commit/f8170ce9f119e5e6724eb81ff1b5a2d4c0024000 - https://hackmd.io/03UGerewRcy3db44JQoWvw
CVE ID: CVE-2024-27298 State: PUBLISHED Published: 2024-03-01T17:48:52.919Z Last Updated: 2024-08-22T18:28:04.258Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: parse-community Products: parse-server Problem Types: CWE-89 Description: parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2 - https://github.com/parse-com
- https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2 - https://github.com/parse-community/parse-server/commit/a6e654943536932904a69b51e513507fcf90a504 - https://github.com/parse-community/parse-server/commit/cbefe770a7260b54748a058b8a7389937dc35833 - https://github.com/parse-community/parse-server/releases/tag/6.5.0 - https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20
CVE ID: CVE-2024-27299 State: PUBLISHED Published: 2024-03-25T18:26:14.879Z Last Updated: 2024-08-02T00:28:00.479Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: thorsten Products: phpMyFAQ Problem Types: CWE-89 Description: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in the the "Add News" functionality due to improper escaping of the email address. This allows any authenticated user with the rights to add/edit FAQ news to exploit this vulnerability to exfiltrate data, take over accounts and in some cases, even achieve RCE. The vulnerable field lies in
s vulnerability to exfiltrate data, take over accounts and in some cases, even achieve RCE. The vulnerable field lies in the `authorEmail` field which uses PHP's `FILTER_VALIDATE_EMAIL` filter. This filter is insufficient in protecting against SQL injection attacks and should still be properly escaped. However, in this version of phpMyFAQ (3.2.5), this field is not escaped properly can be used together with other fields to fully exploit the SQL injection vulnerability. This vulnerability is fixed in 3.2.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-qgxx-4xv5-6hcw - https://github.com/
tainer: References: - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-qgxx-4xv5-6hcw - https://github.com/thorsten/phpMyFAQ/commit/1b68a5f89fb65996c56285fa636b818de8608011 - https://drive.google.com/drive/folders/1BFL8GHIBxSUxu0TneYf66KjFA0A4RZga?usp=sharing
CVE ID: CVE-2024-27300 State: PUBLISHED Published: 2024-03-25T18:30:35.810Z Last Updated: 2024-08-02T00:28:00.229Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: thorsten Products: phpMyFAQ Problem Types: CWE-79 Description: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The `email` field in phpMyFAQ's user control panel page is vulnerable to stored XSS attacks due to the inadequacy of PHP's `FILTER_VALIDATE_EMAIL` function, which only validates the email format, not its content. This vulnerability enables an attacker to execute arbitrary client-side JavaScript within the context of another user's phpM
vulnerability enables an attacker to execute arbitrary client-side JavaScript within the context of another user's phpMyFAQ session. This vulnerability is fixed in 3.2.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-q7g6-xfh2-vhpx - https://github.com/thorsten/phpMyFAQ/commit/09336b0ff0e0a04aa0c97c5975651af4769d2459 - https://github.com/thorsten/phpMyFAQ/commit/de90315c9bd4ead5fe6ba5586f6b016843aa8209
CVE ID: CVE-2024-27301 State: PUBLISHED Published: 2024-03-14T18:37:04.240Z Last Updated: 2024-08-02T00:28:00.245Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: root3nl Products: SupportApp Problem Types: CWE-269 Description: Support App is an opensource application specialized in managing Apple devices. It's possible to abuse a vulnerability inside the postinstall installer script to make the installer execute arbitrary code as root. The cause of the vulnerability is the fact that the shebang `#!/bin/zsh` is being used. When the installer is executed it asks for the users password to be executed as root. However, it'll still be using the $HOME of the user a
is executed it asks for the users password to be executed as root. However, it'll still be using the $HOME of the user and therefore loading the file `$HOME/.zshenv` when the `postinstall` script is executed. An attacker could add malicious code to `$HOME/.zshenv` and it will be executed when the app is installed. An attacker may leverage this vulnerability to escalate privilege on the system. This issue has been addressed in version 2.5.1 Rev 2. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/root3nl/SupportApp/security/advisories/GHSA-jr78-24
nrichment: - CVE Program Container: References: - https://github.com/root3nl/SupportApp/security/advisories/GHSA-jr78-247f-rhqc - https://github.com/root3nl/SupportApp/commit/e866b2aa4028f6a982977f462c0f7550d952c5d0
CVE ID: CVE-2024-27302 State: PUBLISHED Published: 2024-03-06T18:31:31.309Z Last Updated: 2024-08-05T20:09:47.572Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: zeromicro Products: go-zero Problem Types: CWE-639 Description: go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users.
able of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq - https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db
CVE ID: CVE-2024-27303 State: PUBLISHED Published: 2024-03-06T18:35:37.973Z Last Updated: 2024-08-13T17:12:24.776Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: electron-userland Products: electron-builder Problem Types: CWE-426, CWE-427 Description: electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that only affects eletron-builder prior to 24.13.2 in Windows, the NSIS installer makes a system call to open cmd.exe via NSExec in the `.nsh` installer script. NSExec by default searches the current directory of where the installer is located before searching `PA
nstaller script. NSExec by default searches the current directory of where the installer is located before searching `PATH`. This means that if an attacker can place a malicious executable file named cmd.exe in the same folder as the installer, the installer will run the malicious file. Version 24.13.2 fixes this issue. No known workaround exists. The code executes at the installer-level before the app is present on the system, so there's no way to check if it exists in a current installer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/electron-userland/electron-builder/security/advisories/GHSA-r4pf-3v7r-hh55 - https://github.com
es: - https://github.com/electron-userland/electron-builder/security/advisories/GHSA-r4pf-3v7r-hh55 - https://github.com/electron-userland/electron-builder/pull/8059 - https://github.com/electron-userland/electron-builder/commit/8f4acff3c2d45c1cb07779bb3fe79644408ee387
CVE ID: CVE-2024-27304 State: PUBLISHED Published: 2024-03-06T19:07:08.491Z Last Updated: 2024-12-12T20:52:24.821Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: jackc Products: pgx Problem Types: CWE-89, CWE-190 Description: pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exc
ed in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv - https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8 - https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007 - https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4 - https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8 - https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df - http
4753a0c5d22881c12404025724cb05ffd8 - https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df - https://www.youtube.com/watch?v=Tfg1B8u1yvE
CVE ID: CVE-2024-27305 State: PUBLISHED Published: 2024-03-12T20:29:54.592Z Last Updated: 2024-08-02T00:27:59.989Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: aio-libs Products: aiosmtpd Problem Types: CWE-345 Description: aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send smuggle/spoof e-mails with fake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix
ake sender addresses, allowing advanced phishing attacks. This issue is also existed in other SMTP software like Postfix. With the right SMTP server constellation, an attacker can send spoofed e-mails to inbound/receiving aiosmtpd instances. This issue has been addressed in version 1.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-pr2m-px7j-xg65 - https://github.com/aio-libs/aiosmtpd/commit/24b6c79c8921cf1800e27ca144f4f37023982bbb - https://www.postfix.org/smtp-smuggling.html
CVE ID: CVE-2024-27306 State: PUBLISHED Published: 2024-04-18T14:23:25.325Z Last Updated: 2025-11-03T20:37:02.696Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: aio-libs Products: aiohttp Problem Types: CWE-79, CWE-80 Description: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade. Additional Analyst Notes: - CISA ADP Vulnr
on are unaffected. Other users can disable `show_index` if unable to upgrade. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/aio-libs/aiohttp/security/advisories/GHSA-7gpw-8wmc-pm8g - https://github.com/aio-libs/aiohttp/pull/8319 - https://github.com/aio-libs/aiohttp/commit/28335525d1eac015a7e7584137678cbb6ff19397 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EXRGTN2WG7VZLUZ7WOXU5GQJKCPPHKP/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWEI6NIHZ3G7DURDZVMRK7ZEFC2BTD3U/ - https://lists.fedoraproject.org/archives/list/package-anno
fedoraproject.org/message/NWEI6NIHZ3G7DURDZVMRK7ZEFC2BTD3U/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZIVBMPEY7WWOFMC3CWXFBRQPFECV4SW3/
CVE ID: CVE-2024-27307 State: PUBLISHED Published: 2024-03-06T19:24:16.876Z Last Updated: 2024-08-13T17:23:40.132Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: jsonata-js Products: jsonata Problem Types: CWE-1321 Description: JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a malicious expression can use the transform operator to override properties on the `Object` constructor and prototype. This may lead to denial of service, remote code execution or other unexpected behavior in applications that evaluate user-provided JSONata expressions. This issue has been fixed in JSONata versions
behavior in applications that evaluate user-provided JSONata expressions. This issue has been fixed in JSONata versions 1.8.7 and 2.0.4. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. As a workaround, one may apply the patch manually. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jsonata-js/jsonata/security/advisories/GHSA-fqg8-vfv7-8fj8 - https://github.com/jsonata-js/jsonata/commit/1d579dbe99c19fbe509f5ba2c6db7959b0d456d1 - https://github.com/jsonata-js/jsonata/commit/335d38f6278e96c908b24183f1c9c90afc8ae00c - https://github.com/jsonata-js/jsonata/commit/c907b5e517bb718015fcbd99
/commit/335d38f6278e96c908b24183f1c9c90afc8ae00c - https://github.com/jsonata-js/jsonata/commit/c907b5e517bb718015fcbd993d742ba6202f2be2 - https://github.com/jsonata-js/jsonata/releases/tag/v2.0.4
CVE ID: CVE-2024-27308 State: PUBLISHED Published: 2024-03-06T19:27:28.521Z Last Updated: 2024-08-27T16:47:28.665Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: tokio-rs Products: mio Problem Types: CWE-416, CWE-672 Description: Mio is a Metal I/O library for Rust. When using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, thi
may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. This vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable
using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. Vulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tokio-rs/mio/security/advisories/GHSA-r8w9-5wcg-vfj7 - https://github.com/tokio-rs/tokio/issues/6369 - https://github.com/tokio-rs/mio/pull/1760 - https://github.com/tokio-rs/mio/commit/90d4fe00df870acd3d38f3dc4face9aacab8fbb9
CVE ID: CVE-2024-27309 State: PUBLISHED Published: 2024-04-12T06:58:45.134Z Last Updated: 2025-07-30T03:55:45.408Z Vendors: Apache Software Foundation Products: Apache Kafka Problem Types: CWE-863 Description: While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are needed to trigger the bug: 1. The administrator decides to remove an ACL 2. The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal. When those two preconditions are met, Kafka will treat the resource as if it had only one ACL associated with it after the removal, ra
preconditions are met, Kafka will treat the resource as if it had only one ACL associated with it after the removal, rather than the two or more that would be correct. The incorrect condition is cleared by removing all brokers in ZK mode, or by adding a new ACL to the affected resource. Once the migration is completed, there is no metadata loss (the ACLs all remain). The full impact depends on the ACLs in use. If only ALLOW ACLs were configured during the migration, the impact would be limited to availability impact. if DENY ACLs were configured, the impact could include confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored due to this vuln
onfidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored due to this vulnerability during the migration period. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/6536rmzyg076lzzdw2xdktvnz163mjpy - http://www.openwall.com/lists/oss-security/2024/04/12/3 - https://security.netapp.com/advisory/ntap-20240705-0002/