CVE-2025-59792
BaseFortify
Publication date: 2025-11-28
Last updated on: 2025-12-04
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | kvrocks | From 1.0.0 (inc) to 2.14.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-312 | The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Apache Kvrocks involves the MONITOR command revealing plaintext credentials. It affects versions from 1.0.0 through 2.13.0, allowing sensitive credential information to be exposed during monitoring.
How can this vulnerability impact me? :
The vulnerability can lead to exposure of plaintext credentials, which may allow unauthorized users to obtain sensitive authentication information. This could result in unauthorized access to the system or data.
What immediate steps should I take to mitigate this vulnerability?
Users are recommended to upgrade Apache Kvrocks to version 2.14.0, which fixes the issue of plaintext credentials being revealed in the MONITOR command.