CVE-2023-29471

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-29471
Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://akka.io/security/alpakka-kafka-cve-2023-29471.html Vendor Advisory
https://github.com/akka/alpakka-kafka/issues/1592 Issue Tracking
Configurations

Configuration 1 (hide)

cpe:2.3:a:lightbend:alpakka_kafka:*:*:*:*:*:*:*:*
History

05 May 2023, 18:11

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-312
CPE cpe:2.3:a:lightbend:alpakka_kafka:*:*:*:*:*:*:*:*
References (MISC) https://akka.io/security/alpakka-kafka-cve-2023-29471.html - (MISC) https://akka.io/security/alpakka-kafka-cve-2023-29471.html - Vendor Advisory
References (MISC) https://github.com/akka/alpakka-kafka/issues/1592 - (MISC) https://github.com/akka/alpakka-kafka/issues/1592 - Issue Tracking

27 Apr 2023, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-04-27 21:15

Updated : 2024-02-04 23:37

NVD link : CVE-2023-29471

Mitre link : CVE-2023-29471

CVE.ORG link : CVE-2023-29471

JSON object : View

Products Affected

lightbend

  • alpakka_kafka
CWE
CWE-312

Cleartext Storage of Sensitive Information