PT-2025-37098 · Hoverfly · Hoverfly

Kr1Shna4Garwal · CVE-2025-54376 · Publicado 2025-09-10 · Atualizado 2026-07-30

Positive Technologies (AI Summary)

CVSS v4.0

8.8

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Hoverfly versions 1.11.3 and prior

Description: Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs lacks the authentication middleware present in the REST admin API. This allows an unauthenticated remote attacker to stream real-time application logs, potentially exposing sensitive data such as internal file paths and request/response bodies.

Recommendations: Update to version 1.12.0 or later.

Exploit

Correção

Information Disclosure

Improper Authentication

Insertion into Log File

Enumeração de Fraquezas

CWE-200

CWE-287

CWE-532

Identificadores relacionados

CVE-2025-54376

GHSA-JXMR-2H4Q-RHXP

GO-2025-3945

OPENSUSE-SU-2025:15564-1

OPENSUSE-SU-2026:21483-1

SUSE-SU-2025:03289-1

Produtos afetados

Hoverfly

Referências · 1751

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54376.json · Exploit
• https://github.com/SpectoLabs/hoverfly · Nota
• https://github.com/SpectoLabs/hoverfly/commit/ffc2cc34563de67fe1a04f7ba5d78fa2d4564424 · Correção
• https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-jxmr-2h4q-rhxp · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2025-65797 · Nota
• https://suse.com/security/cve/CVE-2026-44427 · Nota
• https://suse.com/security/cve/CVE-2026-27589 · Nota
• https://suse.com/security/cve/CVE-2026-7736 · Nota
• https://suse.com/security/cve/CVE-2026-27137 · Nota
• https://suse.com/security/cve/CVE-2026-25232 · Nota
• https://suse.com/security/cve/CVE-2026-55513 · Nota
• https://suse.com/security/cve/CVE-2026-20736 · Nota
• https://suse.com/security/cve/CVE-2026-32828 · Nota
• https://suse.com/security/cve/CVE-2026-44323 · Nota
• https://suse.com/security/cve/CVE-2026-50551 · Nota