PT-2025-11587 · Unknown · Ntfs Tools

Reza Rashidi · Published 2025-03-18 · Updated 2025-03-18 · CVE-2025-2489

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions NTFS Tools version 3.5.1

Description The issue is related to insecure information storage. An attacker could exploit this to obtain the application password. The password is stored in the /Users/user/Library/Application Support/ntfs-tool/config.json file.

Recommendations For NTFS Tools version 3.5.1, consider removing or securing the config.json file to prevent unauthorized access to the application password. As a temporary workaround, restrict access to the /Users/user/Library/Application Support/ntfs-tool/ directory until a patch is available.

Fix

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

CVE-2025-2489

Affected Products

Ntfs Tools

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-2489 · Security Note
• https://t.me/cvedetector/20567 · Telegram Post
• https://t.me/cvetracker/19359 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/insecure-storage-sensitive-information-ntfs-tool · Note
• https://twitter.com/WolfgangSesin/status/1901985200919523490 · Twitter Post
• https://t.me/cvenotify/115130 · Telegram Post
• https://twitter.com/CVEnew/status/1901961079284215823 · Twitter Post