PT-2025-27572 · Junit · Junit
Ciscoo
·
Publicado
2025-07-01
·
Atualizado
2025-07-01
·
CVE-2025-53103
CVSS v2.0
6.2
Média
| Vetor | AV:L/AC:L/Au:S/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions:
JUnit versions 5.12.0 through 5.13.1
Description:
The issue concerns JUnit's support for writing Open Test Reporting XML files, which can leak Git credentials. The impact depends on the level of the access token exposed through the OpenTestReportGeneratingListener. If test reports are published or stored publicly, an attacker can steal the token and perform elevated actions by impersonating the user or app.
Recommendations:
For versions 5.12.0 through 5.13.1, update to version 5.13.2 to resolve the issue. As a temporary workaround, consider restricting access to the OpenTestReportGeneratingListener to minimize the risk of exploitation. Avoid publishing or storing test reports publicly until the issue is resolved.
Exploit
Correção
Cleartext Storage of Sensitive Information
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Junit