Privilege escalation in Apache Kafka
CVE-2024-31141
Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in orde…
Vulnerability class: Privilege Escalation
EPSS: 0.011 (62.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Apache Kafka — versions 3.7.0
- Apache Software Foundation Kafka Clients — versions 2.3.0, 3.6.0, 3.7.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Third Party Advisory)
Frequently asked questions
- What is CVE-2024-31141?
- CVE-2024-31141 is a medium-severity vulnerability in Apache Kafka, classified under Improper Privilege Management. CVSS score: 6.5/10. Published 2024-11-19.
- How severe is CVE-2024-31141?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2024-31141 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.