CVE-2019-0201

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
Apache Software FoundationApache ZooKeeper1.0.0 to 3.4.13; 3.5.0-alpha to 3.5.4-beta

References

Timeline

Published
May 23, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-02027.5The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versionCVE-2019-02037.5In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends CVE-2019-02047.8A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the comCVE-2019-02057.5In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input dataCVE-2019-02077.5Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter CVE-2019-02107.5In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid inpCVE-2019-02117.8In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes orCVE-2019-02127.5In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBaseCVE-2019-02136.5In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vuCVE-2019-02146.5In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mecCVE-2019-02157.5In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 CVE-2019-02164.8A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page view
CVE-2019-0201: Medium severity, CVSS 5.9 | Vulnix