CVE-2025-15107

Katalog CVE

CVSS 8.1 · High EPSS 0,62%

Kerentanan Key Management Errors pada actionsky sqle. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

A security vulnerability has been detected in actiontech sqle up to 4.2511.0. The impacted element is an unknown function of the file sqle/utils/jwt.go of the component JWT Secret Handler. The manipulation of the argument JWTSecretKey leads to use of hard-coded cryptographic key . The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report and is planning to fix this flaw in an upcoming release.

Rincian

Terbit di NVD

27 Desember 2025

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-320: Key Management Errors
CWE-321: Use of Hard-coded Cryptographic Key
CWE-798: Use of Hard-coded Credentials

EPSS (30 hari)

0,62% peluang dieksploitasi; lebih tinggi dari 48,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/actiontech/sqle/issues/3186 exploit · advisory pihak ketiga
• https://vuldb.com/?id.338478 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.710380 advisory pihak ketiga · vdb entry
• https://github.com/actiontech/sqle/milestone/53 exploit
• https://vuldb.com/?ctiid.338478 permissions required · vdb entry