cve.bz

CVE-2018-8012

7.5 highEPSS 8.4%

No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
8.4% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWE
CWE-862
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-ccqf-c5hq-77mpMavenorg.apache.zookeeper:zookeeper<3.4.103.4.10
GHSA-ccqf-c5hq-77mpMavenorg.apache.zookeeper:zookeeper>=3.5.0-alpha <3.5.4-beta3.5.4-beta

References

Check your stackJSON