CVE-2025-35434

Katalog CVE

CVSS 9.8 · Critical EPSS 0,20%

Kerentanan Improper Certificate Validation pada cisa thorium. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. An unauthenticated attacker with access to a Thorium cluster could impersonate the Elasticsearch service. Fixed in 1.1.2.

Rincian

Terbit di NVD

17 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-259-01.json advisory vendor
• https://www.cve.org/CVERecord?id=CVE-2025-35434 advisory pihak ketiga
• https://github.com/cisagov/thorium/blob/main/api/src/models/backends/setup/elastic_setup.rs#L36-L43 product
• https://github.com/cisagov/thorium/releases/tag/1.1.2 release notes