← CVE Intelligence

CVE-2019-12399

Apache / Kafka PUBLISHED

Description (CNA)

When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.

Affected (CNA)

Vendor / productVersions
Apache / Kafkaaffected Apache Kafka 2.0.0; affected 2.0.1; affected 2.1.0; affected 2.1.1; affected 2.2.0; affected 2.2.1; affected 2.3.0

CWE

No CWE identifiers supplied.

References

ADP enrichment

CVE

No English description supplied.