CVE-2019-0201

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-05-23 · updated 2026-06-17
Weakness: CWE-862

Description

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.

Affected products

Apache ActiveMQ: 5.15.9
Apache Software Foundation Apache Drill: 1.16.0
Apache Software Foundation Apache ZooKeeper: from 1.0.0 through 3.4.13; 3.5.0, 3.5.0-alpha, 3.5.0-rc0, 3.5.1, 3.5.1-alpha, 3.5.1-rc0 (+13)
Debian Linux: 8.0, 9.0
NetApp Element Software: all versions
NetApp Hci Bootstrap Os: all versions
Oracle Corporation GoldenGate Stream Analytics: before 19.1.0.0.1 — fixed in 19.1.0.0.1
Oracle Siebel Core - Server Framework: through 21.5
Oracle Corporation TimesTen In-Memory Database: before 18.1.3.1.0 — fixed in 18.1.3.1.0
Red Hat Fuse: 1.0.0

How to fix

Upgrade to a fixed version: Oracle Corporation GoldenGate Stream Analytics 19.1.0.0.1; Oracle Corporation TimesTen In-Memory Database 18.1.3.1.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-0201 or the next vulnerability affects your stack