CVE-2025-54872

Katalog CVE

CVSS 8.7 · High EPSS 0,35%

Kerentanan Use of Hard-coded Credentials. Skor CVSS 4.0 8.7 (High) menurut github.com.

Deskripsi (NVD)

onion-site-template is a complete, scalable tor hidden service self-hosting sample. Versions which include commit 3196bd89 contain a baked-in tor image if the secrets were copied from an existing onion domain. A website could be compromised if a user shared the baked-in image, or if someone were able to acquire access to the user's device outside of a containerized environment. This is fixed by commit bc9ba0fd.

Rincian

Terbit di NVD

6 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 4.0

8.7 (High), sumber github.com
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-798: Use of Hard-coded Credentials

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/Vessel9817/onion-site-template/commit/bc9ba0fd8cc7fbb3abc6759b351885a4501bce84
• https://github.com/Vessel9817/onion-site-template/security/advisories/GHSA-mj8m-c8w9-rw55