PT-2025-21262 · Unknown · Bluewave Checkmate

Published 2025-05-15 · Updated 2025-05-15 · CVE-2025-48024

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: BlueWave Checkmate versions prior to 2.1

Description: The issue allows an authenticated regular user to access sensitive application secrets. This is achieved via the "/api/v1/settings" endpoint.

Recommendations: For versions prior to 2.1, update to version 2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/api/v1/settings" endpoint to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-497

Related Identifiers

CVE-2025-48024

GHSA-JJMG-CJR4-439M

Affected Products

Bluewave Checkmate

References · 10

• https://osv.dev/vulnerability/CVE-2025-48024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48024 · Security Note
• https://github.com/bluewave-labs/Checkmate/security/advisories/GHSA-jjmg-cjr4-439m · Note
• https://github.com/bluewave-labs/Checkmate/commit/36d78a9aa4ed607ca1bd2b5fdaca5a3927b2d287 · Note
• https://github.com/bluewave-labs/Checkmate/pull/2227 · Note
• https://github.com/bluewave-labs/Checkmate/commit/7a855ef47adf2265121c236097059c7c6555fd7c · Note
• https://github.com/bluewave-labs/Checkmate/commit/91c2f7f0d5106bdfd4a0ff2c14b7e44acc3baee6 · Note
• https://twitter.com/CVEnew/status/1922876039635538322 · Twitter Post
• https://t.me/cvenotify/122269 · Telegram Post
• https://t.me/cvetracker/23888 · Telegram Post