CVE-2024-27309
highpriority · track · 0OT risk · elevatedEPSS 0.011 · 66 %ileDEEUNLUSEPSS · scored 2026-10-27
While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are needed to trigger the bug: 1. The administrator decides to remove an ACL 2. The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal. When those two preconditions are met, Kafka will treat the resource as if it had only one ACL associated with it after the removal, rather than the two or more that would be correct. The incorrect condition is cleared by removing all brokers in ZK mode, or by adding a new ACL to the affected resource. Once the migration is completed, there is no metadata loss (the ACLs all remain). The full impact depends on the ACLs in use. If only ALLOW ACLs were configured during the migration, the impact would be limited to availability impact. if DENY ACLs were configured, the impact could include confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored due to this vulnerability during the migration period.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.8–7.4
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (24)
Products and version ranges known to be affected.
- communications_applicationsall versionsncsc_nlNLcpe:2.3:a:oracle:communications_applications:3.0.3.3.0:*:*:*:*:*:*:*
- communications_applicationsall versionsncsc_nlNLcpe:2.3:a:oracle:communications_applications:15.0.0.0:*:*:*:*:*:*:*
- communications_applicationsall versionsncsc_nlNLcpe:2.3:a:oracle:communications_applications:15.0.1.0:*:*:*:*:*:*:*
- communications_applicationsall versionsncsc_nlNLcpe:2.3:a:oracle:communications_applications:3.0.2.0.0:*:*:*:*:*:*:*
- communications_applicationsall versionsncsc_nlNLcpe:2.3:a:oracle:communications_applications:3.0.3.0.0:*:*:*:*:*:*:*
- communications_applicationsall versionsncsc_nlNLcpe:2.3:a:oracle:communications_applications:8.0.0.3:*:*:*:*:*:*:*
- communications_applicationsall versionsncsc_nlNLcpe:2.3:a:oracle:communications_applications:8.1.0.1:*:*:*:*:*:*:*
- communications_applicationsall versionsncsc_nlNLcpe:2.3:a:oracle:communications_applications:8.1.0.26:*:*:*:*:*:*:*
- communications_applicationsall versionsncsc_nlNLcpe:2.3:a:oracle:communications_applications:7.4.0:*:*:*:*:*:*:*
- communications_applicationsall versionsncsc_nlNLcpe:2.3:a:oracle:communications_applications:7.4.1:*:*:*:*:*:*:*
- communications_applicationsall versionsncsc_nlNLcpe:2.3:a:oracle:communications_applications:7.4.2:*:*:*:*:*:*:*
- communications_applicationsall versionsncsc_nlNLcpe:2.3:a:oracle:communications_applications:7.5.0:*:*:*:*:*:*:*
- communications_service_catalog_and_designall versionsncsc_nlNLcpe:2.3:a:oracle:communications_service_catalog_and_design:8.1.0.1:*:*:*:*:*:*:*
- communications_service_catalog_and_designall versionsncsc_nlNLcpe:2.3:a:oracle:communications_service_catalog_and_design:8.0.0.3:*:*:*:*:*:*:*
- oracle communications applicationsall versionsncsc_nlNLcpe:2.3:a:oracle:communications_applications:*:*:*:*:*:*:*:*
advisories (6)
Vendor and ecosystem advisories describing this.
- NCSC-2025-0021Kwetsbaarheden verholpen in Oracle CommunicationsNL2025-01-22csaf · ncsc_nlNL
Oracle heeft meerdere kwetsbaarheden verholpen in zijn Communicatieproducten, waaronder Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Network Function en Oracle Communications Order and Service Management.
- WID-SEC-W-2024-0857Apache Kafka: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2024-04-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Kafka ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
- WID-SEC-W-2025-0135Oracle Communications Applications: Mehrere SchwachstellenDeutsch2025-01-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2025-1564Oracle Siebel CRM: Mehrere SchwachstellenDeutsch2025-07-15csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Siebel CRM ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- GHSA-79vv-vp32-gpp7Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode2024-04-12ghsa · osvUS
While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are needed to trigger the bug: 1. The administrator decides to remove an ACL 2. The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal. When those two preconditions are met, Kafka will treat the resource as if it had only one ACL associated with it after the removal, rather than the two or more that would be correct. The incorrect condition is cleared by removing all brokers in ZK mode, or by adding a new ACL to the affected resource. Once the migration is completed, there is no metadata loss (the ACLs all remain). The full impact depends on the ACLs in use. If only ALLOW ACLs were configured during the migration, the impact would be limited to availability impact. if DENY ACLs were configured, the impact could include confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored due to this vulnerability during the migration period.
- BIT-kafka-2024-273092024-04-16vendor · osvUS
While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced.Two preconditions are needed to trigger the bug:1. The administrator decides to remove an ACL2. The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal.When those two preconditions are met, Kafka will treat the resource as if it had only one ACL associated with it after the removal, rather than the two or more that would be correct.The incorrect condition is cleared by removing all brokers in ZK mode, or by adding a new ACL to the affected resource. Once the migration is completed, there is no metadata loss (the ACLs all remain).The full impact depends on the ACLs in use. If only ALLOW ACLs were configured during the migration, the impact would be limited to availability impact. if DENY ACLs were configured, the impact could include confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored due to this vulnerability during the migration period.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (12)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2024/04/12/3cnnvd
- https://cxsecurity.com/cveshow/CVE-2024-27309/cnnvd
- https://lists.apache.org/thread/6536rmzyg076lzzdw2xdktvnz163mjpycnnvd
- https://security.netapp.com/advisory/ntap-20240705-0002/cnnvd
- https://www.oracle.com/security-alerts/cpujan2025.htmlcnnvd
- https://www.oracle.com/security-alerts/cpujul2025.htmlcnnvd
- http://www.openwall.com/lists/oss-security/2024/04/12/3enisa_euvd
- https://lists.apache.org/thread/6536rmzyg076lzzdw2xdktvnz163mjpyenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan