PT-2025-37098 · Hoverfly · Hoverfly

Kr1Shna4Garwal · Publicado 2025-09-10 · Atualizado 2025-09-24 · CVE-2025-54376

Positive Technologies (AI Summary)

CVSS v4.0

8.8

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Hoverfly versions 1.11.3 and prior

Description: Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs lacks the authentication middleware present in the REST admin API. This allows an unauthenticated remote attacker to stream real-time application logs, potentially exposing sensitive data such as internal file paths and request/response bodies.

Recommendations: Update to version 1.12.0 or later.

Exploit

Correção

Insertion into Log File

Information Disclosure

Improper Authentication

Enumeração de Fraquezas

CWE-532

CWE-200

CWE-287

Identificadores relacionados

CVE-2025-54376

GHSA-JXMR-2H4Q-RHXP

GO-2025-3945

OPENSUSE-SU-2025:15564-1

SUSE-SU-2025:03289-1

Produtos afetados

Hoverfly

Referências · 51

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54376.json · Exploit
• https://github.com/SpectoLabs/hoverfly/commit/ffc2cc34563de67fe1a04f7ba5d78fa2d4564424 · Correção
• https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-jxmr-2h4q-rhxp · Aviso do Fabricante
• https://github.com/SpectoLabs/hoverfly · Nota
• https://suse.com/security/cve/CVE-2025-8077 · Nota
• https://suse.com/security/cve/CVE-2025-58450 · Nota
• https://suse.com/security/cve/CVE-2025-9566 · Nota
• https://twitter.com/VulmonFeeds/status/1965888970975252683 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2025-54123 · Nota
• https://suse.com/security/cve/CVE-2024-58259 · Nota
• https://suse.com/security/cve/CVE-2025-5187 · Nota
• https://osv.dev/vulnerability/GHSA-jxmr-2h4q-rhxp · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2025-3945 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2025-58058 · Nota
• https://suse.com/security/cve/CVE-2025-56761 · Nota