6.5
CVE-2025-52493
- EPSS 0.04%
- Veröffentlicht 10.12.2025 00:00:00
- Zuletzt bearbeitet 02.01.2026 14:38:05
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginPagerDuty Runbook through 2025-06-12 exposes stored secrets directly in the webpage DOM at the configuration page. Although these secrets appear masked as password fields, the actual secret values are present in the page source and can be revealed by simply modifying the input field type from "password" to "text" using browser developer tools. This vulnerability is exploitable by administrative users who have access to the configuration page.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Pagerduty ≫ Runbook Automation Version <= 2025-06-12
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.04% | 0.12 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.