CVE-2025-62232
BaseFortify
Publication date: 2025-10-31
Last updated on: 2025-11-05
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | apisix | From 1.0 (inc) to 3.14.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Apache APISIX's basic-auth plugin causes sensitive data exposure by logging plaintext usernames and passwords to error logs and log sinks when the log level is set to INFO or DEBUG. This means that credentials can be compromised if unauthorized users gain access to these logs. [2]
How can this vulnerability impact me? :
The vulnerability can lead to credential compromise because sensitive usernames and passwords are stored in plaintext within logs. If an attacker or unauthorized party accesses these logs, they can obtain valid credentials, potentially leading to unauthorized access to systems or data. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking your Apache APISIX logs for plaintext usernames and passwords in error logs when the log level is set to INFO or DEBUG. Specifically, search the error logs for basic-auth credentials exposure. For example, use commands like: grep -i 'basic-auth' /path/to/apisix/logs/error.log or grep -E 'username|password' /path/to/apisix/logs/error.log to identify sensitive data exposure. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Apache APISIX to version 3.14, which contains the fix for this vulnerability. Additionally, avoid setting the log level to INFO or DEBUG in production environments to prevent sensitive data from being logged. Review and restrict access to existing logs that may contain exposed credentials. [2]