PT-2025-27572 · Junit · Junit

Ciscoo · Published 2025-07-01 · Updated 2025-07-01 · CVE-2025-53103

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: JUnit versions 5.12.0 through 5.13.1

Description: The issue concerns JUnit's support for writing Open Test Reporting XML files, which can leak Git credentials. The impact depends on the level of the access token exposed through the OpenTestReportGeneratingListener. If test reports are published or stored publicly, an attacker can steal the token and perform elevated actions by impersonating the user or app.

Recommendations: For versions 5.12.0 through 5.13.1, update to version 5.13.2 to resolve the issue. As a temporary workaround, consider restricting access to the OpenTestReportGeneratingListener to minimize the risk of exploitation. Avoid publishing or storing test reports publicly until the issue is resolved.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2025-53103

GHSA-M43G-M425-P68X

Affected Products

Junit

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53103.json · Exploit
• https://cve.org/CVERecord?id=CVE-2025-53103 · Security Note
• https://osv.dev/vulnerability/GHSA-m43g-m425-p68x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53103 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-53103 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-53103 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-53103 · Vendor Advisory
• https://github.com/junit-team/junit-framework/blob/6b7764dac92fd35cb348152d1b37f8726875a4e0/junit-platform-reporting/src/main/java/org/junit/platform/reporting/open/xml/OpenTestReportGeneratingListener.java#L183 · Note
• https://github.com/junit-team/junit-framework · Note
• https://github.com/junit-team/junit-framework/commit/d4fc834c8c1c0b3168cd030c13551d1d041f51bc · Note
• https://github.com/junit-team/junit-framework/security/advisories/GHSA-m43g-m425-p68x · Note
• https://twitter.com/VulmonFeeds/status/1940168808783569296 · Twitter Post
• https://twitter.com/CVEnew/status/1940120772170637736 · Twitter Post