cve.bz

CVE-2017-12610

6.8 mediumEPSS 2.9%

In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.

Severity

CVSS 3.0

6.8 medium
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS
2.9% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
CWE
CWE-287
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-xm78-4m3g-7wm7Mavenorg.apache.kafka:kafka-clients>=0.10.0.0 <0.10.2.20.10.2.2
GHSA-xm78-4m3g-7wm7Mavenorg.apache.kafka:kafka-clients>=0.11.0.0 <0.11.0.20.11.0.2

References

Check your stackJSON