{"url":"http://public2.vulnerablecode.io/api/packages/626756?format=json","purl":"pkg:maven/org.apache.zookeeper/zookeeper@3.6.2","type":"maven","namespace":"org.apache.zookeeper","name":"zookeeper","version":"3.6.2","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"3.8.6","latest_non_vulnerable_version":"3.9.5","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19420?format=json","vulnerability_id":"VCID-d5ku-8mny-tfed","summary":"Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like 'eve@EXAMPLE.COM', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default.\n\nUsers are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2, which fixes the issue.\n\nAlternately ensure the ensemble election/quorum communication is protected by a firewall as this will mitigate the issue.\n\nSee the documentation for more details on correct cluster administration.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-44981.json","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-44981.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-44981","reference_id":"","reference_type":"","scores":[{"value":"0.00025","scoring_system":"epss","scoring_elements":"0.06797","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00025","scoring_system":"epss","scoring_elements":"0.06727","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00025","scoring_system":"epss","scoring_elements":"0.06726","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00025","scoring_system":"epss","scoring_elements":"0.0672","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00025","scoring_system":"epss","scoring_elements":"0.06821","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00025","scoring_system":"epss","scoring_elements":"0.06802","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00025","scoring_system":"epss","scoring_elements":"0.06795","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00025","scoring_system":"epss","scoring_elements":"0.06639","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00025","scoring_system":"epss","scoring_elements":"0.06712","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00025","scoring_system":"epss","scoring_elements":"0.06647","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00027","scoring_system":"epss","scoring_elements":"0.07418","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00027","scoring_system":"epss","scoring_elements":"0.07392","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00027","scoring_system":"epss","scoring_elements":"0.07474","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00027","scoring_system":"epss","scoring_elements":"0.07437","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-44981"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44981","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44981"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/apache/zookeeper","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/zookeeper"},{"reference_url":"https://lists.apache.org/thread/wf0yrk84dg1942z1o74kd8nycg6pgm5b","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-23T13:27:01Z/"}],"url":"https://lists.apache.org/thread/wf0yrk84dg1942z1o74kd8nycg6pgm5b"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00029.html","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-23T13:27:01Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00029.html"},{"reference_url":"https://security.netapp.com/advisory/ntap-20240621-0007","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.netapp.com/advisory/ntap-20240621-0007"},{"reference_url":"https://www.debian.org/security/2023/dsa-5544","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-23T13:27:01Z/"}],"url":"https://www.debian.org/security/2023/dsa-5544"},{"reference_url":"http://www.openwall.com/lists/oss-security/2023/10/11/4","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-23T13:27:01Z/"}],"url":"http://www.openwall.com/lists/oss-security/2023/10/11/4"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054224","reference_id":"1054224","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054224"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243436","reference_id":"2243436","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243436"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44981","reference_id":"CVE-2023-44981","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44981"},{"reference_url":"https://github.com/advisories/GHSA-7286-pgfv-vxvh","reference_id":"GHSA-7286-pgfv-vxvh","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7286-pgfv-vxvh"},{"reference_url":"https://security.netapp.com/advisory/ntap-20240621-0007/","reference_id":"ntap-20240621-0007","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-23T13:27:01Z/"}],"url":"https://security.netapp.com/advisory/ntap-20240621-0007/"},{"reference_url":"https://access.redhat.com/errata/RHSA-2023:7678","reference_id":"RHSA-2023:7678","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2023:7678"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:0705","reference_id":"RHSA-2024:0705","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:0705"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:0903","reference_id":"RHSA-2024:0903","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:0903"},{"reference_url":"https://usn.ubuntu.com/6559-1/","reference_id":"USN-6559-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6559-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60514?format=json","purl":"pkg:maven/org.apache.zookeeper/zookeeper@3.7.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-w64v-sgpz-7fhj"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.zookeeper/zookeeper@3.7.2"},{"url":"http://public2.vulnerablecode.io/api/packages/60515?format=json","purl":"pkg:maven/org.apache.zookeeper/zookeeper@3.8.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-6789-5wwx-qqch"},{"vulnerability":"VCID-w64v-sgpz-7fhj"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.zookeeper/zookeeper@3.8.3"},{"url":"http://public2.vulnerablecode.io/api/packages/60516?format=json","purl":"pkg:maven/org.apache.zookeeper/zookeeper@3.9.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-6789-5wwx-qqch"},{"vulnerability":"VCID-ex8w-efvg-2qgv"},{"vulnerability":"VCID-hbdm-1ts5-f7ad"},{"vulnerability":"VCID-w64v-sgpz-7fhj"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.zookeeper/zookeeper@3.9.1"}],"aliases":["CVE-2023-44981","GHSA-7286-pgfv-vxvh"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-d5ku-8mny-tfed"}],"fixing_vulnerabilities":[],"risk_score":"4.5","resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.zookeeper/zookeeper@3.6.2"}