Search: CVE-2024-23944

Apache ZooKeeper versions 3.6.0 through before 3.8.4 and 3.9.0 through before 3.9.2 contain an information disclosure vulnerability in the handling of persistent watchers. The issue arises from a missing ACL check when a persistent watcher is triggered, allowing an attacker with access to a parent znode to monitor child znodes and see their full paths. Although the znode data is not exposed, the path information can contain sensitive details such as usernames or login IDs. Upgrading to versions 3.8.4 or 3.9.2 resolves this vulnerability.