Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-30677
CVE-2025-30677:
Java vulnerability analysis and mitigation
Overview
Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The vulnerability (CVE-2025-30677) affects the Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Adaptor Sink Connector, which log sensitive configuration properties in plain text in application logs. The issue affects Apache Pulsar IO's Apache Kafka connectors in all versions before 3.0.11, 3.3.6, and 4.0.4, and was discovered by Kyler Katz (Apache Security).
Technical details
The vulnerability stems from the improper handling of sensitive configuration properties in application logs, where these properties are logged in plain text format. The issue has been assigned CWE-532 (Insertion of Sensitive Information into Log File). The vulnerability has received a CVSS 4.0 Base Score of 6.3 (MEDIUM) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N (NVD Database).
Impact
This vulnerability can lead to unintended exposure of credentials in log files, potentially allowing attackers with access to these logs to obtain Apache Kafka credentials. The vulnerability's impact is limited by the fact that an attacker would need access to the application logs to exploit this issue (OSS Security).
Mitigation and workarounds
Users are advised to upgrade to the patched versions: 3.0.x version users should upgrade to at least 3.0.11, 3.3.x version users should upgrade to at least 3.3.6, and 4.0.x version users should upgrade to at least 4.0.4. Users operating versions prior to those listed should upgrade to the aforementioned patched versions or newer versions (Apache Security).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management