CVE-2025-51055
BaseFortify
Publication date: 2025-08-06
Last updated on: 2025-10-09
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vedo_suite_project | vedo_suite | 2024.17 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-312 | The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves insecure data storage where credentials, secret keys, and database information are stored in clear-text within the /api_vedo/configuration/config.yml file in Vedo Suite version 2024.17. This means sensitive information is not properly protected and can be easily accessed by unauthorized users.
How can this vulnerability impact me? :
The impact of this vulnerability is that attackers or unauthorized users could access sensitive credentials and secret keys stored in clear-text, potentially leading to unauthorized access to systems, data breaches, and compromise of database information.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability could negatively affect compliance with standards and regulations such as GDPR and HIPAA, which require proper protection of sensitive data. Storing credentials and secret keys in clear-text may violate data protection requirements and lead to non-compliance.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking for the presence of the /api_vedo/configuration/config.yml file on your system and inspecting it for clear-text credentials, secret keys, and database information. For example, use commands like 'cat /api_vedo/configuration/config.yml' or 'grep -i password /api_vedo/configuration/config.yml' to look for sensitive information stored in clear text.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include removing or encrypting the sensitive credentials stored in /api_vedo/configuration/config.yml, restricting access permissions to this file to authorized users only, and updating to a version of Vedo Suite that addresses this insecure data storage issue once available.