CVE-2025-60794

Katalog CVE

CVSS 6.5 · Medium EPSS 0,21%

Kerentanan Cleartext Storage of Sensitive Information in Memory pada perfood couchauth. Skor CVSS 3.1 6.5 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. This creates a window of opportunity for sensitive data extraction through memory dumps, debugging tools, or other memory access techniques, potentially leading to session hijacking.

Rincian

Terbit di NVD

20 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-316: Cleartext Storage of Sensitive Information in Memory

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60794.md advisory pihak ketiga
• https://github.com/perfood/couch-auth product
• https://www.npmjs.com/package/@perfood/couch-auth product