User Impersonation Vulnerability in Apache Kafka by Confluent

CVE-2017-12610

What is CVE-2017-12610?

In Apache Kafka versions 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients can exploit a vulnerability that allows them to impersonate other users. This can be achieved through the manipulation of protocol messages while utilizing either SASL/PLAIN or SASL/SCRAM authentication methods. This impersonation risk poses significant threats to the security and integrity of data handled by Kafka, making it essential for users to implement security measures and updates to safeguard against potential exploitation.

References