What is CVE-2023-25194?

CVE-2023-25194 is a vulnerability in Apache Software Foundation Kafka Connect Api, classified under Deserialization of Untrusted Data. Published 2023-02-07.

Is CVE-2023-25194 known to be exploited?

39 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Deserialization in Apache Software Foundation Kafka Connect Api

CVE-2023-25194

A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL…

Vulnerability class: Insecure Deserialization

EPSS: 0.941 (99.9th percentile) — read the EPSS interpretation.

Affected products

Apache Software Foundation Kafka Connect Api — versions 2.3.0

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

Public proof-of-concept exploits

References

kafka.apache.org/cve-list (release-notes)
lists.apache.org/thread/vy1c7fqcdqvq5grcqp6q5jyyb302khyz (vendor-advisory)
packetstormsecurity.com/files/173151/Apache-Druid-JNDI-Injection-Remote-Code-Ex…

Frequently asked questions

What is CVE-2023-25194?: CVE-2023-25194 is a vulnerability in Apache Software Foundation Kafka Connect Api, classified under Deserialization of Untrusted Data. Published 2023-02-07.
Is CVE-2023-25194 known to be exploited?: 39 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.