CVE-2019-12399

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-01-14 · updated 2026-06-17
Weakness: CWE-319

Description

When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.

Affected products

Apache Kafka: 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1 (+1)
Oracle Banking Corporate Lending Process Management: 14.1.0, 14.3.0, 14.4.0
Oracle Banking Credit Facilities Process Management: 14.1.0, 14.3.0, 14.4.0
Oracle Corporation Oracle Banking Liquidity Management: from 14.0.0 through 14.4.0
Oracle Corporation Banking Payments: 14.4.0
Oracle Banking Platform: 2.7.0
Oracle Banking Supply Chain Finance: from 14.2.0 through 14.4.0
Oracle Corporation Oracle Banking Trade Finance Process Management: 14.1.0, 14.3.0, 14.4.0
Oracle Corporation Banking Virtual Account Management: 14.1.0, 14.3.0, 14.4.0
Oracle Blockchain Platform: before 21.1.2 — fixed in 21.1.2
Oracle Communications Cloud Native Core Policy: 1.9.0
Oracle Corporation Financial Services Analytical Applications Infrastructure: from 8.0.6 through 8.1.0
Oracle Corporation FLEXCUBE Universal Banking: 14.4.0

How to fix

Upgrade to a fixed version: Oracle Blockchain Platform 21.1.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-12399 or the next vulnerability affects your stack