April 19, 2024
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
New Steganography Attack ‘SteganoAmor’ Targets 320 Organizations Globally – Active IOCs
April 17, 2024
“Stealc” – An Information Stealer Malware – Active IOCs
April 18, 2024
New Steganography Attack ‘SteganoAmor’ Targets 320 Organizations Globally – Active IOCs
April 17, 2024
“Stealc” – An Information Stealer Malware – Active IOCs
April 18, 2024
Severity
High
Analysis Summary
CVE-2024-27309 CVSS:7.5
Apache Kafka is vulnerable to a denial of service, caused by improper access control during migration from ZK mode to KRaft mode. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVE-2024-31391 CVSS:6.5
Apache Solr Operator could allow a remote authenticated attacker to obtain sensitive information, caused by the insertion of sensitive information into log file when authentication is in use. By gaining access to the log file, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
Impact
- Denial of Service
- Information Disclosure
Indicators of Compromise
CVE
- CVE-2024-27309
- CVE-2024-31391
Affected Vendors
Apache
Affected Products
- Apache Kafka 3.5.0
- Apache Kafka 3.5.1
- Apache Kafka 3.5.2
- Apache Kafka 3.6.0
- Apache Kafka 3.6.1
- Apache Solr Operator 0.3.0
- Apache Solr Operator 0.8.0
Remediation
Refer to Apache Website for patch, upgrade, or suggested workaround information.