CVE-2025-26864

Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID Authentication

CVSS 7.5 HIGHEPSS 0.7%CWE-200 CWE-532

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 7.5EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

14 mai 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB. This issue affects Apache IoTDB: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2. Users are recommended to upgrade to version 1.3.4 and 2.0.2, which fix the issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Produtos afetados

Apache Software Foundation · Apache IoTDB

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://lists.apache.org/thread/2kcjnlypppk8qjh17dpz0jvkcpn6l162 http://www.openwall.com/lists/oss-security/2025/05/14/4