« Volver al listado

CVE-2025-30677

Estado: AnalizadaMedia (6.3)—

Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Adaptor Sink Connector log sensitive configuration properties in plain text in application logs.

This vulnerability can lead to unintended exposure of credentials in log files, potentially allowing attackers with access to these logs to obtain Apache Kafka credentials. The vulnerability's impact is limited by the fact that an attacker would need access to the application logs to exploit this issue.

This issue affects Apache Pulsar IO's Apache Kafka connectors in all versions before 3.0.11, 3.3.6, and 4.0.4.

Leer descripción completaMostrar menos

3.0.x version users should upgrade to at least 3.0.11.

3.3.x version users should upgrade to at least 3.3.6.

4.0.x version users should upgrade to at least 4.0.4.

Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Pulsar

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-30677",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-30677",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-09T13:09:23.522782Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security@apache.org",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 6.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Pulsar IO Kafka Connector",
          "versions": [
            {
              "status": "affected",
              "version": "2.3.0",
              "lessThan": "3.0.11",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.1.0",
              "lessThan": "3.3.6",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.0.0",
              "lessThan": "4.0.4",
              "versionType": "semver"
            }
          ],
          "packageName": "org.apache.pulsar:pulsar-io-kafka",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Pulsar IO Kafka Connect Adaptor",
          "versions": [
            {
              "status": "affected",
              "version": "2.3.0",
              "lessThan": "3.0.11",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.1.0",
              "lessThan": "3.3.6",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.0.0",
              "lessThan": "4.0.4",
              "versionType": "semver"
            }
          ],
          "packageName": "org.apache.pulsar:pulsar-io-kafka-connect-adaptor",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-04-09T12:15:15.363",
  "references": [
    {
      "url": "https://lists.apache.org/thread/zv5fwwrh374r1p5cmksxcd40ssxxko3d",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://pulsar.apache.org/security/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/04/09/2",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Adaptor Sink Connector log sensitive configuration properties in plain text in application logs.\n\n\nThis vulnerability can lead to unintended exposure of credentials in log files, potentially allowing attackers with access to these logs to obtain Apache Kafka credentials. The vulnerability's impact is limited by the fact that an attacker would need access to the application logs to exploit this issue.\n\nThis issue affects Apache Pulsar IO's Apache Kafka connectors in all versions before 3.0.11, 3.3.6, and 4.0.4.\n\n\n3.0.x version users should upgrade to at least 3.0.11.\n\n3.3.x version users should upgrade to at least 3.3.6.\n\n4.0.x version users should upgrade to at least 4.0.4.\n\n\nUsers operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions."
    },
    {
      "lang": "es",
      "value": "Apache Pulsar contiene múltiples conectores para la integración con Apache Kafka. Los conectores de origen, receptor y receptor del adaptador Kafka Connect de Pulsar IO registran propiedades de configuración sensibles en texto plano en los registros de la aplicación. Esta vulnerabilidad puede provocar la exposición involuntaria de credenciales en los archivos de registro, lo que podría permitir a atacantes con acceso a estos registros obtener credenciales de Apache Kafka. El impacto de la vulnerabilidad es limitado debido a que un atacante necesitaría acceder a los registros de la aplicación para explotar este problema. Este problema afecta a los conectores de Apache Kafka de Apache Pulsar IO en todas las versiones anteriores a la 3.0.11, 3.3.6 y 4.0.4. Los usuarios de la versión 3.0.x deben actualizar al menos a la 3.0.11. Los usuarios de la versión 3.3.x deben actualizar al menos a la 3.3.6. Los usuarios de la versión 4.0.x deben actualizar al menos a la 4.0.4. Los usuarios de versiones anteriores a las mencionadas anteriormente deben actualizar a las versiones parcheadas mencionadas o a versiones más recientes."
    }
  ],
  "lastModified": "2026-06-17T09:09:09.897",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67B90A7D-A5DA-4CA6-8FAD-95B56693FB49",
              "versionEndExcluding": "3.0.11",
              "versionStartIncluding": "2.3.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "689CD007-FC77-4F5D-A6EF-344BEFD4E3A9",
              "versionEndExcluding": "3.3.6",
              "versionStartIncluding": "3.3.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B465449A-7F8D-49F2-AE8A-067D1C8A23D3",
              "versionEndExcluding": "4.0.4",
              "versionStartIncluding": "4.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}