CVE-2025-54999

openbao

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2025-54999

Katalog CVE

CVSS 3.7 · Low EPSS 0,20%

Kerentanan Observable Discrepancy pada openbao. Skor CVSS 3.1 3.7 (Low) menurut NVD.

Deskripsi (NVD)

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, when using OpenBao's userpass auth method, user enumeration was possible due to timing difference between non-existent users and users with stored credentials. This is independent of whether the supplied credentials were valid for the given user. This issue was fixed in version 2.3.2. To work around this issue, users may use another auth method or apply rate limiting quotas to limit the number of requests in a period of time: https://openbao.org/api-docs/system/rate-limit-quotas/.

Rincian

Terbit di NVD
9 Agustus 2025
Terakhir diubah
17 Juni 2026
Status NVD
Analyzed
CVSS 3.1
3.7 (Low), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-203: Observable Discrepancy
EPSS (30 hari)
0,20% peluang dieksploitasi; lebih tinggi dari 9,2% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
openbao openbao Semua versi sebelum 2.3.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.