CVE-2025-67874

Katalog CVE

CVSS 6.5 · Medium EPSS 0,36%

Kerentanan Observable Response Discrepancy pada churchcrm. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by users in subsequent HTTP responses. This information disclosure significantly increases the risk of credential compromise and may amplify the impact of other vulnerabilities (e.g., XSS, IDOR, session fixation), enabling attackers to harvest other users’ passwords. Version 6.5.0 fixes the issue.

Rincian

Terbit di NVD

16 Desember 2025

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-204: Observable Response Discrepancy

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-p98h-5xcj-5c6x exploit · advisory vendor
• https://github.com/ChurchCRM/CRM/commit/2d6cf7aed9af1b9b47e125d1a2266f8e2a88f3fd patch