CVE-2025-52893

Katalog CVE

CVSS 4.5 · Medium EPSS 0,33%

Kerentanan Insertion of Sensitive Information into Log File pada openbao. Skor CVSS 3.1 4.5 (Medium) menurut github.com.

Deskripsi (NVD)

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. This issue has been fixed in OpenBao v2.3.0 and later. Like with HCSEC-2025-09, there is no known workaround except to ensure properly formatted requests from all clients.

Rincian

Terbit di NVD

25 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 23,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openbao/openbao/security/advisories/GHSA-8f5r-8cmq-7fmq advisory vendor
• https://github.com/openbao/openbao/commit/cf5e920badbf96b41253534a3fd5ff5063bf4b30 patch
• https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-proces... not applicable
• https://github.com/go-viper/mapstructure/commit/ed3f92181528ff776a0324107b8b55026e93766a not applicable
• https://github.com/go-viper/mapstructure/pull/105 not applicable
• https://github.com/go-viper/mapstructure/releases/tag/v2.3.0 not applicable