CVE-2023-25194

🗓️ 07 Feb 2023 19:11:22Reported by apacheType

cve🔗 web.nvd.nist.gov👁 411 Views🌐 WEB

A security vulnerability in Apache Kafka Connect API allows for RCE via LDAP server connection

Reporter	Title	Published	Views	Family All 86
zdt	Apache Druid JNDI Injection Remote Code Execution Exploit	27 Jun 202300:00	–	zdt
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	7 Mar 202303:26	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in kafka-clients-2.8.2.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2023-25194)	1 Feb 202413:37	–	ibm
IBM Security Bulletins	Security Bulletin: z/Transaction Processing Facility is affected by vulnerabilities in the Apache Kafka (kafka-clients) and cryptography packages	9 Mar 202314:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM includes components with known vulnerabilities	6 Jul 202318:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to a code execution vulnerability in Apache Kafka (CVE-2023-25194)	17 May 202321:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM webMethods BPM is vulnerable to a denial of service due to kafka-clients	17 Feb 202604:39	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for March 2023	1 Apr 202314:09	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Operator for Apache Flink	30 Dec 202513:32	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in kafka-clients-2.8.2.jar used by IBM Maximo Asset Management application (CVE-2023-25194)	1 Feb 202413:36	–	ibm

NVD

Vulners

Node

apache kafka_connectRange2.3.0–3.3.2

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Kafka Connect API",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "3.4.0",
        "status": "affected",
        "version": "2.3.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
kafka	www.kafka.apache.org/cve-list
lists	www.lists.apache.org/thread/vy1c7fqcdqvq5grcqp6q5jyyb302khyz
packetstormsecurity	www.packetstormsecurity.com/files/173151/Apache-Druid-JNDI-Injection-Remote-Code-Execution.html

Parameter	Position	Path	Description	CWE
for=connect	query param	/druid/indexer/v1/sampler	JNDI injection vulnerability in Apache Druid (via Kafka clients) where an attacker can manipulate the sasl.jaas.config property to trigger remote code execution via LDAP.	CWE-502
config.database.history.producer.sasl.jaas.config	request body	/connectors	Kafka Connect REST API allows an authenticated operator to set the sasl.jaas.config property, enabling JNDI injection and RCE.	CWE-502

17 Jun 2026 05:40Current

7.5High risk

Vulners AI Score7.5

CVSS 3.18.8

EPSS0.9581

SSVC