CVSS 3.1
5.5 mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2023-29471
Medium (5.5) in lightbend alpakka kafka. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in com.typesafe.akka:akka-stream-kafka_3 4.0.2.
Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 4% of CVEs (scores of 2026-10-31)
- CWE
- CWE-312
- Published
- Modified
- Record from
- the NVD, synced
Affected
- lightbend:alpakka_kafka
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-55vq-xpjf-r2xc | Maven | com.typesafe.akka:akka-stream-kafka_3 | <4.0.2 | 4.0.2 |
| GHSA-55vq-xpjf-r2xc | Maven | com.typesafe.akka:akka-stream-kafka_2.13 | <4.0.2 | 4.0.2 |
| GHSA-55vq-xpjf-r2xc | Maven | com.typesafe.akka:akka-stream-kafka_2.12 | <4.0.2 | 4.0.2 |
| GHSA-55vq-xpjf-r2xc | Maven | com.typesafe.akka:akka-stream-kafka_2.11 | all versions | no fix published |