CVE-2025-54376

Katalog CVE

CVSS 7.5 · High EPSS 0,71%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada hoverfly. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same authentication middleware that guards the REST admin API. Consequently, an unauthenticated remote attacker can stream real-time application logs (information disclosure) and/or gain insight into internal file paths, request/response bodies, and other potentially sensitive data emitted in logs. Version 1.12.0 contains a fix for the issue.

Rincian

Terbit di NVD

10 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-287: Improper Authentication
CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

0,71% peluang dieksploitasi; lebih tinggi dari 52,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-jxmr-2h4q-rhxp exploit · advisory vendor
• https://github.com/SpectoLabs/hoverfly/commit/ffc2cc34563de67fe1a04f7ba5d78fa2d4564424 patch