CVE-2025-35054

Katalog CVE

CVSS 5.3 · Medium EPSS 0,08%

Kerentanan Storing Passwords in a Recoverable Format pada newforma project center. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\<version>\Credentials'. The credentials are encrypted but the encryption key is stored in the same registry location. Authenticated users can access both the credentials and the encryption key. If these are Active Directory credentials, an attacker may be able to gain access to additional systems and resources.

Rincian

Terbit di NVD

9 Oktober 2025

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-257: Storing Passwords in a Recoverable Format
CWE-522: Insufficiently Protected Credentials
CWE-922: Insecure Storage of Sensitive Information

EPSS (30 hari)

0,08% peluang dieksploitasi; lebih tinggi dari 0,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json advisory pihak ketiga
• https://www.cve.org/CVERecord?id=CVE-2025-35054 advisory pihak ketiga