CVE-2025-62705

Katalog CVE

CVSS 4.9 · Medium EPSS 0,33%

Kerentanan Insertion of Sensitive Information into Log File pada openbao. Skor CVSS 3.1 4.9 (Medium) menurut NVD.

Deskripsi (NVD)

OpenBao is an open source identity-based secrets management system. Prior to version 2.4.2, OpenBao's audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters rather than strings. This includes, but is not limited to sys/raw with use of encoding=base64, all data would be emitted unredacted to the audit log, and Transit, when performing a signing operation with a derived Ed25519 key, would emit public keys to the audit log. This issue has been patched in OpenBao 2.4.2.

Rincian

Terbit di NVD

22 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openbao/openbao/security/advisories/GHSA-rc54-2g2c-g36g patch · advisory vendor
• https://github.com/openbao/openbao/commit/cc2c476bac66e1d94776c2629793daec3af625f8 patch