CVE-2025-8525
BaseFortify
Publication date: 2025-08-04
Last updated on: 2025-08-28
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| exrick | xboot | to 3.3.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-8525 is an information disclosure vulnerability in Exrick xboot versions up to 3.3.4. It occurs because the application allows unauthenticated remote access to Spring Boot Admin and Spring Actuator endpoints. This unauthorized access exposes extensive server configuration details and environment variables, potentially revealing sensitive internal information about the server environment. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing remote attackers to access sensitive server configuration details and environment variables without authentication. This information disclosure can aid attackers in further exploiting the system or conducting reconnaissance, potentially compromising the confidentiality of your server environment. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to access the unauthenticated Spring Boot Admin and Spring Actuator endpoints on the affected xboot server. For example, you can use curl or a web browser to check if the following URLs are accessible without authentication: http://<target-ip>:<port>/xboot/admin/wallboard and http://<target-ip>:<port>/xboot/actuator. If these endpoints return server configuration details or environment variables, the system is vulnerable. [2]
What immediate steps should I take to mitigate this vulnerability?
No known countermeasures or mitigations have been identified for this vulnerability. It is suggested to consider replacing the affected product with an alternative. Additionally, restricting access to the Spring Boot Admin and Spring Actuator endpoints by network controls or authentication mechanisms may help reduce exposure until a patch or fix is available. [3]