7.5

CVE-2025-26864

EPSS 0.1%
Veröffentlicht 14.05.2025 10:44:12
Zuletzt bearbeitet 01.07.2025 19:23:28
Quelle security@apache.org
CVE-Watchlists
Login
Unerledigt
Login

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB.

This issue affects Apache IoTDB: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2.

Users are recommended to upgrade to version 1.3.4 and 2.0.2, which fix the issue.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 2 Referenzen 5

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD

Diese Information steht angemeldeten Benutzern zur Verfügung.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Apache ≫ Iotdb Version >= 0.10.0 < 1.3.4

Apache ≫ Iotdb Version2.0.1 Updatebeta

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.1%	0.286

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CWE-532 Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.

https://lists.apache.org/thread/2kcjnlypppk8qjh17dpz0jvkcpn6l162

Vendor Advisory

Mailing List

http://www.openwall.com/lists/oss-security/2025/05/14/4

Mailing List

https://nvd.nist.gov/vuln/detail/CVE-2025-26864

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-26864

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-26864

EUVD