BaseFortify

Publication date: 2025-11-21

Last updated on: 2025-12-02

Assigner: JPCERT/CC

Description

LogStare Collector improperly handles the password hash data. An administrative user may obtain the other users' password hashes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-21

Last Modified

2025-12-02

Generated

2026-07-06

AI Q&A

2025-11-21

EPSS Evaluated

2026-07-05

NVD

CVE-2025-64299

EUVD

EUVD-2025-198424

Affected Vendors & Products

Vendor	Product	Version / Range
secuavail	logstare_collector	to 2.4.2 (exc)
linux	linux_kernel	*
microsoft	windows	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-201	The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

Executive Summary

This vulnerability in LogStare Collector allows an administrative user to improperly access other users' password hashes due to improper handling of password hash data.

Impact Analysis

An administrative user could obtain other users' password hashes, potentially leading to unauthorized access if those hashes are cracked or misused, compromising user account security.

Hi! I’m here to help you understand CVE-2025-64299. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70