PT-2025-23499 · Para · Para

Albogdanopublished · Published 2025-05-30 · Updated 2025-06-02 · CVE-2025-48955

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Para versions prior to 1.50.8

Description A vulnerability exists in Para, a multitenant backend server/framework for object persistence and retrieval, which exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require logging for debugging or system health purposes.

Recommendations For versions prior to 1.50.8, update to version 1.50.8 to fix the issue. As a temporary workaround, consider restricting log access to minimize the risk of credential exposure. Avoid logging access and secret keys for debugging or system health purposes until the issue is resolved.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2025-48955

GHSA-V75G-77VF-6JJQ

Affected Products

Para

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48955.json · Exploit
• https://osv.dev/vulnerability/GHSA-v75g-77vf-6jjq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48955 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48955 · Vendor Advisory
• https://github.com/Erudika/para/security/advisories/GHSA-v75g-77vf-6jjq · Note
• https://github.com/Erudika/para/commit/1e8a89558542854bb0683ab234c4429ad93b0835 · Note
• https://github.com/Erudika/para · Note
• https://twitter.com/CVEnew/status/1929500868203962847 · Twitter Post
• https://t.me/cvetracker/25167 · Telegram Post
• https://t.me/cvenotify/124332 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1929537733317292051 · Twitter Post