CVE-2023-29471

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://akka.io/security/alpakka-kafka-cve-2023-29471.htmlVendor Advisory
https://github.com/akka/alpakka-kafka/issues/1592Issue Tracking
https://akka.io/security/alpakka-kafka-cve-2023-29471.htmlVendor Advisory
https://github.com/akka/alpakka-kafka/issues/1592Issue Tracking

Timeline

Published: Apr 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-294739.8webservice in Atos Unify OpenScape 4000 Platform and OpenScape 4000 Manager Platform 10 R1 before 10 R1.34.4 allows an unauthenticated attac CVE-2023-294749.8inventory in Atos Unify OpenScape 4000 Platform and OpenScape 4000 Manager Platform 10 R1 before 10 R1.34.4 allows an unauthenticated attack CVE-2023-294759.8inventory in Atos Unify OpenScape 4000 Platform and OpenScape 4000 Manager Platform 10 R1 before 10 R1.34.4 allows an unauthenticated attack CVE-2023-294769.1In Menlo On-Premise Appliance before 2.88, web policy may not be consistently applied properly to intentionally malformed client requests. T CVE-2023-294789.8BiblioCraft before 2.4.6 does not sanitize path-traversal characters in filenames, allowing restricted write access to almost anywhere on th CVE-2023-294795.3Ribose RNP before 0.16.3 may hang when the input is malformed.CVE-2023-29486.1Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-294807.5Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.CVE-2023-294837.0eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending CVE-2023-294846.5In Terminalfour before 8.3.16, misconfigured LDAP users are able to login with an invalid password.CVE-2023-294859.8An issue was discovered in Heimdal Thor agent versions 3.4.2 and before on Windows and 2.6.9 and before on macOS, allows attackers to bypass CVE-2023-294869.8An issue was discovered in Heimdal Thor agent versions 3.4.2 and before 3.7.0 on Windows, allows attackers to bypass USB access restrictions