PT-2025-12666 · Unknown+1 · Kanidm-Provision+1

Published 2025-03-24 · Updated 2025-03-24 · CVE-2025-30205

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions kanidm-provision versions prior to 1.2.0

Description The issue is related to a faulty function instrumentation in the optional kanidm patches provided by kanidm-provision, which causes the provisioned admin credentials to be leaked to the system log. This only affects users who use the provided patches and provision their admin or idm admin account credentials. No other credentials are affected.

Recommendations For versions prior to 1.2.0, recompile kanidm with the newest patchset from tag v1.2.0 or higher. As a temporary workaround, set the log level KANIDM LOG LEVEL to any level higher than info, for example warn.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2025-30205

GHSA-57FC-PCQM-53RP

Affected Products

Kanidm

Kanidm-Provision

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30205.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-30205 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30205 · Security Note
• https://github.com/oddlama/kanidm-provision/commit/a102b52e4a79be4263068577ba837f16c3e487a2 · Note
• https://github.com/oddlama/kanidm-provision/security/advisories/GHSA-57fc-pcqm-53rp · Note
• https://t.me/cvedetector/20987 · Telegram Post
• https://twitter.com/CVEnew/status/1904220997366276340 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1904320387879424140 · Twitter Post
• https://t.me/cvetracker/19780 · Telegram Post