寒泉

**Name of the Vulnerable Software and Affected Versions** Apache ZooKeeper versions prior to 3.9.2 Apache ZooKeeper versions prior to 3.8.4 **Description** The issue is related to information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. The ZooKeeper server doesn't do ACL check when the persistent watcher is triggered, and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. Only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Approximately 83,109 devices are potentially affected, mainly distributed in China and the United States. **Recommendations** To resolve the issue, upgrade to version 3.9.2 or 3.8.4, which fixes the issue. As a temporary workaround, consider restricting access to the `addWatch` command to minimize the risk of exploitation. Avoid using sensitive information in znode paths until the issue is resolved.