CVE-2019-12399

apache kafka, oracle banking corporate lending process management, oracle banking credit facilities process management +10 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2019-12399

Katalog CVE

CVSS 7.5 · High EPSS 3,9%

Kerentanan Cleartext Transmission of Sensitive Information pada apache kafka, oracle banking corporate lending process management +11 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.

Rincian

Terbit di NVD
14 Januari 2020
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-319: Cleartext Transmission of Sensitive Information
EPSS (30 hari)
3,9% peluang dieksploitasi; lebih tinggi dari 90,0% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
apache kafka Versi 2.0.0
apache kafka Versi 2.0.1
apache kafka Versi 2.1.0
apache kafka Versi 2.1.1
apache kafka Versi 2.2.0
apache kafka Versi 2.2.1
apache kafka Versi 2.3.0
oracle banking corporate lending process management Versi 14.1.0
oracle banking corporate lending process management Versi 14.3.0
oracle banking corporate lending process management Versi 14.4.0
oracle banking credit facilities process management Versi 14.1.0
oracle banking credit facilities process management Versi 14.3.0
oracle banking credit facilities process management Versi 14.4.0
oracle banking liquidity management Versi 14.0.0 hingga 14.4.0
oracle banking payments Versi 14.4.0
oracle banking platform Versi 2.7.0
oracle banking supply chain finance Versi 14.2.0 hingga 14.4.0
oracle banking trade finance process management Versi 14.1.0
oracle banking trade finance process management Versi 14.3.0
oracle banking trade finance process management Versi 14.4.0
oracle banking virtual account management Versi 14.1.0
oracle banking virtual account management Versi 14.3.0
oracle banking virtual account management Versi 14.4.0
oracle blockchain platform Semua versi sebelum 21.1.2
oracle communications cloud native core policy Versi 1.9.0
oracle financial services analytical applications infrastructure Versi 8.0.6 hingga 8.1.0
oracle flexcube universal banking Versi 14.4.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.