Klaw Improper Access Control Vulnerability Allowing Password Hash Disclosure

An improper access control vulnerability has been identified in Klaw, a self-service Apache Kafka topic management tool, in versions through 2.10.3. This vulnerability allows for the unauthorized disclosure of password hashes. The issue has been addressed in version 2.10.4, where the affected endpoint was removed from the application.

Impact

The vulnerability could lead to the unauthorized disclosure of password hashes, potentially allowing for password cracking or unauthorized access.

Remediation

Users can upgrade to Klaw version 2.10.4 to address this vulnerability. The release is available on the Klaw GitHub repository.