CVE-2025-62513
BaseFortify
Publication date: 2025-10-22
Last updated on: 2025-10-27
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openbao | openbao | to 2.3.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in OpenBao versions 2.2.0 to 2.4.1 is a regression where raw HTTP request bodies were improperly logged in audit logs without proper redaction (HMAC). It affects the ACME functionality of the PKI module by leaking short-lived ACME verification challenge codes, and the OIDC issuer functionality of the identity subsystem by leaking authentication and token response codes along with claims. These sensitive data exposures occur in audit logs, potentially visible to those with access to logs. The issue was fixed in version 2.4.2. [1]
How can this vulnerability impact me? :
The vulnerability can lead to leakage of sensitive information such as ACME verification challenge codes and OIDC authentication and token response codes in audit logs. This exposure can compromise confidentiality by revealing short-lived verification codes and authentication tokens. However, the ACME codes are of limited long-term use as they expire after verification or challenge expiry. Users not using the affected functionalities are not impacted. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by inspecting the audit logs of OpenBao versions 2.2.0 to 2.4.1 for the presence of unredacted raw HTTP request bodies, especially those related to the ACME functionality of the PKI module and the OIDC issuer functionality. Look for leaked ACME verification challenge codes or authentication and token response codes in the logs. Specific commands are not provided in the resources, but reviewing log files for sensitive data exposure in these areas is recommended. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade OpenBao to version 2.4.2 or later, where the vulnerability has been patched. Additionally, review and restrict access to audit logs to prevent unauthorized viewing of sensitive data. If upgrading immediately is not possible, consider disabling or limiting the use of the affected ACME and OIDC functionalities until the patch can be applied. [1]