PT-2023-22270 · Lightbend · Alpakka Kafka
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Lightbend Alpakka Kafka versions prior to 5.0.0
Description
The issue allows log files to contain credentials if plain cleartext login is configured, as the configuration is logged as debug information. This occurs in the
akka.kafka.internal.KafkaConsumerActor.Recommendations
For versions prior to 5.0.0, update to version 5.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to log files to minimize the risk of credential exposure.
Exploit
Fix
Cleartext Storage of Sensitive Information
Insertion into Log File
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alpakka Kafka