CVE-2025-25209
BaseFortify
Publication date: 2025-06-09
Last updated on: 2025-06-09
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Red Hat Connectivity Link involves the AuthPolicy metadata storing secrets by referencing them in the kuadrant-system namespace without copying them to the target namespace. This design flaw allows a malicious developer with access to leak these secrets over an HTTP connection if they know the exact secret names. The secrets are limited to one line only, and the attacker must have developer-level permissions and knowledge of the secret names to exploit this. [1]
How can this vulnerability impact me? :
An attacker with developer persona access can exfiltrate secrets from the kuadrant-system namespace that they are not authorized to access. This can lead to unauthorized disclosure of sensitive information, potentially compromising confidentiality and integrity of systems relying on those secrets. The attack requires knowledge of secret names and can be performed over an HTTP connection, increasing the risk of data leakage. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, restrict developer persona access to the kuadrant-system namespace to prevent unauthorized access to secrets. Ensure secrets are not exposed over HTTP connections and avoid relying on the assumption that secrets are already present in the kuadrant-system namespace. Monitor and control access to secret names to reduce the risk of brute force discovery. Since no fixed version or patch is specified yet, apply strict access controls and network monitoring as immediate mitigation steps. [1]