CVE-2025-54120
BaseFortify
Publication date: 2025-07-23
Last updated on: 2025-07-25
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pcl_community | plain_craft_launcher | 2.12.0-beta.5 |
| pcl_community | plain_craft_launcher | 2.12.0-beta.9 |
| pcl_community | plain_craft_launcher | 2.12.0-beta.10 |
| pcl_community | plain_craft_launcher | 2.12.0-beta.8 |
| pcl_community | plain_craft_launcher | 2.12.0-beta.7 |
| pcl_community | plain_craft_launcher | 2.12.0-beta.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
In certain versions of the PCL (Plain Craft Launcher) Community Edition Minecraft launcher (versions 2.12.0-beta.5 to 2.12.0-beta.9), the login credentials used during third-party login are accidentally saved in a local log file. Although this log file is not automatically shared or uploaded, if a user manually shares the log file, their credentials could be exposed.
How can this vulnerability impact me? :
If an attacker gains access to the local log file containing the saved login credentials, or if a user inadvertently shares this log file, the attacker could obtain the user's login credentials. This could lead to unauthorized access to the user's account or other security breaches.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if your PCL Community Edition version is between 2.12.0-beta.5 and 2.12.0-beta.9. Additionally, inspect local log files generated by the launcher for any recorded login credentials. Since the vulnerability involves credentials being recorded in local logs, you can search for sensitive information in the log files. For example, on a system where the logs are stored, you might use commands like 'grep' to search for keywords related to login credentials within the log files. However, exact log file locations and names are not specified.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the PCL Community Edition to version 2.12.0-beta.10 or later, where this vulnerability is fixed. Additionally, users should avoid sharing or sending the local log files that may contain recorded login credentials to prevent leakage.