CVE-2025-48929

Katalog CVE

CVSS 9.8 · Critical EPSS 0,32%

Kerentanan Insecure Storage of Sensitive Information pada smarsh telemessage. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expiration time) that can be reused at a later date if discovered by an adversary.

Rincian

Terbit di NVD

28 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-922: Insecure Storage of Sensitive Information
CWE-613: Insufficient Session Expiration

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/ press/media coverage