CVE-2025-53602
BaseFortify
Publication date: 2025-07-04
Last updated on: 2025-07-08
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1188 | The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Zipkin through version 3.5.1, where the /heapdump endpoint, related to the Spring Boot Actuator, is exposed. This endpoint can potentially allow unauthorized access to heap dump data, which may contain sensitive information. It is similar to the issue described in CVE-2025-48927.
How can this vulnerability impact me? :
The vulnerability can impact you by exposing sensitive information through the /heapdump endpoint without requiring authentication. This could lead to information disclosure, potentially aiding attackers in understanding the application's memory and exploiting other vulnerabilities. The CVSS score of 5.3 indicates a medium severity with network attack vector and no privileges required.