CVE-2018-1288

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-07-26 · updated 2026-06-17

Description

In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.

Affected products

Apache Kafka: from 0.9.0.0 (excl.) through 0.9.0.1; from 0.10.0.0 through 0.10.2.1; from 0.11.0.0 through 0.11.0.2; 1.0.0
Oracle Database: 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c
Oracle Corporation Primavera P6 Enterprise Project Portfolio Management: from 19.12.0.0 through 19.12.6.0
Oracle Corporation TimesTen In-Memory Database: before 18.1.2.1.0 — fixed in 18.1.2.1.0
RedHat Jboss Middleware Text-Only Advisories: 1.0

How to fix

Upgrade to a fixed version: Oracle Corporation TimesTen In-Memory Database 18.1.2.1.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-1288 or the next vulnerability affects your stack