Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/21515?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/21515?format=api", "vulnerability_id": "VCID-hbdm-1ts5-f7ad", "summary": "Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands\nImproper permission checks in the AdminServer allow an authenticated client with insufficient privileges to invoke the `snapshot` and `restore` commands. The intended requirement is authentication and authorization on the root path (`/`) with **ALL** permission for these operations; however, affected versions permit invocation without that level of authorization. The primary risk is disclosure of cluster state via snapshots to a lesser-privileged client.\n\n* **Affected:** `org.apache.zookeeper:zookeeper` 3.9.0 through 3.9.3.\n* **Fixed:** 3.9.4 (ZOOKEEPER-4964 “check permissions individually during admin server auth”).\n* **Mitigations:**\n* Disable both commands (`admin.snapshot.enabled`, `admin.restore.enabled`).\n* Disable AdminServer (`admin.enableServer`).\n* Ensure the root ACL is not open; note that ZooKeeper ACLs are not recursive.\n* Upgrade to 3.9.4.", "aliases": [ { "alias": "CVE-2025-58457" }, { "alias": "GHSA-2hmj-97jw-28jh" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/944024?format=api", "purl": "pkg:deb/debian/zookeeper@0?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/zookeeper@0%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/944015?format=api", "purl": "pkg:deb/debian/zookeeper@3.4.13-6%2Bdeb11u1?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1t8x-dmby-ubep" }, { "vulnerability": "VCID-6789-5wwx-qqch" }, { "vulnerability": "VCID-w64v-sgpz-7fhj" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/zookeeper@3.4.13-6%252Bdeb11u1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/944013?format=api", "purl": "pkg:deb/debian/zookeeper@3.8.0-11%2Bdeb12u2?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1t8x-dmby-ubep" }, { "vulnerability": "VCID-6789-5wwx-qqch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/zookeeper@3.8.0-11%252Bdeb12u2%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/944026?format=api", "purl": "pkg:deb/debian/zookeeper@3.9.4-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/zookeeper@3.9.4-1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/1054874?format=api", "purl": "pkg:deb/debian/zookeeper@3.9.5-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/zookeeper@3.9.5-1" }, { "url": "http://public2.vulnerablecode.io/api/packages/944016?format=api", "purl": "pkg:deb/debian/zookeeper@3.9.5-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/zookeeper@3.9.5-1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/63948?format=api", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6789-5wwx-qqch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.zookeeper/zookeeper@3.9.4" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/944017?format=api", "purl": "pkg:deb/debian/zookeeper@3.9.3-1%2Bdeb13u1?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1t8x-dmby-ubep" }, { "vulnerability": "VCID-6789-5wwx-qqch" }, { "vulnerability": "VCID-hbdm-1ts5-f7ad" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/zookeeper@3.9.3-1%252Bdeb13u1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/1054873?format=api", "purl": "pkg:deb/debian/zookeeper@3.9.3-1%2Bdeb13u1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1t8x-dmby-ubep" }, { "vulnerability": "VCID-6789-5wwx-qqch" }, { "vulnerability": "VCID-hbdm-1ts5-f7ad" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/zookeeper@3.9.3-1%252Bdeb13u1" }, { "url": "http://public2.vulnerablecode.io/api/packages/60513?format=api", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1t8x-dmby-ubep" }, { "vulnerability": "VCID-6789-5wwx-qqch" }, { "vulnerability": "VCID-d5ku-8mny-tfed" }, { "vulnerability": "VCID-ex8w-efvg-2qgv" }, { "vulnerability": "VCID-hbdm-1ts5-f7ad" }, { "vulnerability": "VCID-w64v-sgpz-7fhj" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.zookeeper/zookeeper@3.9.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/60516?format=api", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6789-5wwx-qqch" }, { "vulnerability": "VCID-ex8w-efvg-2qgv" }, { "vulnerability": "VCID-hbdm-1ts5-f7ad" }, { "vulnerability": "VCID-w64v-sgpz-7fhj" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.zookeeper/zookeeper@3.9.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/55940?format=api", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6789-5wwx-qqch" }, { "vulnerability": "VCID-ex8w-efvg-2qgv" }, { "vulnerability": "VCID-hbdm-1ts5-f7ad" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.zookeeper/zookeeper@3.9.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/57440?format=api", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6789-5wwx-qqch" }, { "vulnerability": "VCID-hbdm-1ts5-f7ad" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.zookeeper/zookeeper@3.9.3" } ], "references": [ { "reference_url": "http://github.com/apache/zookeeper/commit/71e173fcbcc9deb784081cf867bd045df3c32635", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://github.com/apache/zookeeper/commit/71e173fcbcc9deb784081cf867bd045df3c32635" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-58457.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-58457.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-58457", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00108", "scoring_system": "epss", "scoring_elements": "0.28968", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00131", "scoring_system": "epss", "scoring_elements": "0.32598", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00131", "scoring_system": "epss", "scoring_elements": "0.32636", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00131", "scoring_system": "epss", "scoring_elements": "0.32634", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00131", "scoring_system": "epss", "scoring_elements": "0.32609", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00131", "scoring_system": "epss", "scoring_elements": "0.32561", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00131", "scoring_system": "epss", "scoring_elements": "0.32705", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00131", "scoring_system": "epss", "scoring_elements": "0.32585", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00131", "scoring_system": "epss", "scoring_elements": "0.32608", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00131", "scoring_system": "epss", "scoring_elements": "0.3257", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00131", "scoring_system": "epss", "scoring_elements": "0.3274", "published_at": "2026-04-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-58457" }, { "reference_url": "https://github.com/apache/zookeeper", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/zookeeper" }, { "reference_url": "https://lists.apache.org/thread/r5yol0kkhx2fzw22pxk1ozwm3oc6yxrx", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-24T13:47:31Z/" } ], "url": "https://lists.apache.org/thread/r5yol0kkhx2fzw22pxk1ozwm3oc6yxrx" }, { "reference_url": "https://zookeeper.apache.org/doc/current/zookeeperSnapshotAndRestore.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://zookeeper.apache.org/doc/current/zookeeperSnapshotAndRestore.html" }, { "reference_url": "https://zookeeper.apache.org/doc/r3.9.4/releasenotes.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://zookeeper.apache.org/doc/r3.9.4/releasenotes.html" }, { "reference_url": "https://zookeeper.apache.org/security.html#CVE-2025-58457", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://zookeeper.apache.org/security.html#CVE-2025-58457" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2025/09/24/10", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2025/09/24/10" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1116339", "reference_id": "1116339", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1116339" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397773", "reference_id": "2397773", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397773" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58457", "reference_id": "CVE-2025-58457", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58457" }, { "reference_url": "https://github.com/advisories/GHSA-2hmj-97jw-28jh", "reference_id": "GHSA-2hmj-97jw-28jh", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-2hmj-97jw-28jh" } ], "weaknesses": [ { "cwe_id": 280, "name": "Improper Handling of Insufficient Permissions or Privileges ", "description": "The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." }, { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." } ], "exploits": [], "severity_range_score": "4.0 - 6.9", "exploitability": "0.5", "weighted_severity": "6.2", "risk_score": 3.1, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-hbdm-1ts5-f7ad" }