CVE-2025-27819

highPriorität · verfolgen · 0EPSS 0.010 · 64. PerzentilDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.03% (64th) EPSS

CVSS 8.8 · high

Is it mine?

35 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.9–8.8

v3.18.8highAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HsecondaryAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-502USCWE-502USCWE-502US

betroffene Produkte (35)

Betroffene Produkte und Versionsbereiche.

Apache Kafka <3.9.1alle Versionencert_bundDE
Apache Kafka <4.0.0alle Versionencert_bundDE
IBM App Connect Enterprise 12.0.1.0-12.0.12.15alle Versionencert_bundDEcpe:/a:ibm:app_connect_enterprise:12.0.1.0_-_12.0.12.15
IBM App Connect Enterprise 13.0.1.0-13.0.4.0alle Versionencert_bundDEcpe:/a:ibm:app_connect_enterprise:13.0.1.0_-_13.0.4.0
IBM App Connect Enterprise <12.14.0alle Versionencert_bundDE
IBM App Connect Enterprise <LTS 12.0.14alle Versionencert_bundDE
IBM Business Automation Workflowalle Versionencert_bundDEcpe:/a:ibm:business_automation_workflow:-
IBM InfoSphere Data Replicationalle Versionencert_bundDEcpe:/a:ibm:infosphere_data_replication:-
IBM InfoSphere Information Serveralle Versionencert_bundDEcpe:/a:ibm:infosphere_information_server:-
IBM Integration Bus for z/OS 10.1.0.0-10.1.0.5alle Versionencert_bundDEcpe:/a:ibm:integration_bus:10.1.0.0_-_10.1.0.5::for_zos
IBM Maximo Asset Management 7.6.1alle Versionencert_bundDEcpe:/a:ibm:maximo_asset_management:7.6.1
IBM Operational Decision Manageralle Versionencert_bundDEcpe:/a:ibm:operational_decision_manager:-
IBM QRadar SIEM <7.5.0 UP13alle Versionencert_bundDE
IBM Security Guardium 11.5alle Versionencert_bundDEcpe:/a:ibm:security_guardium:11.5
IBM Tivoli Network Manager IP Edition <4.2 Fix Pack 23alle Versionencert_bundDE
Red Hat Enterprise Linuxalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:-
Apache Kafka< 3.9.1cert_bundDE
Apache Kafka< 4.0.0cert_bundDE
IBM App Connect Enterprise< 12.14.0cert_bundDE
IBM App Connect Enterprise< LTS 12.0.14cert_bundDE

20 von 35 angezeigt

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2025-1269Apache Kafka: Mehrere SchwachstellenDeutsch2025-06-09csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Apache Kafka ausnutzen, um Informationen offenzulegen, beliebigen Programmcode auszuführen oder einen Denial-of-Service auszulösen.
GHSA-mcwh-c9pg-xw43Apache Kafka Deserialization of Untrusted Data vulnerability2025-06-10ghsa · osvUS
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0
BIT-kafka-2025-27819Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration2025-06-14vendor · osvUS
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv cert_bund NVD CVE.org MITRE

veröffentlicht 2025-06-10geändert 2026-06-17

Referenzen (6)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan