PT-2025-29919 · Rucio-Ui+2 · Rucio-Ui+3

Stevenctimm · Published 2025-07-17 · Updated 2025-07-17 · CVE-2025-54064

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions rucio-server versions 37.0.2, 35.0.1, and 32.0.1 rucio-ui versions 37.0.4, 35.0.1, and 32.0.2 rucio-webui versions 37.0.2, 35.1.1, and 32.0.1

Description Rucio is a software framework used to organize, manage, and access large volumes of scientific data. The X-Rucio-Auth-Token header, containing user credentials, is included in the Apache access log format for rucio-server, rucio-ui, and rucio-webui components. This exposes potentially sensitive credentials (Internal Rucio token or JWT) in the access logs, especially if these logs are accessible to unauthorized individuals.

Recommendations rucio-server versions prior to 37.0.2, 35.0.1, and 32.0.1: Update to version 37.0.2, 35.0.1, or 32.0.1. rucio-ui versions prior to 37.0.4, 35.0.1, and 32.0.2: Update to version 37.0.4, 35.0.1, or 32.0.2. rucio-webui versions prior to 37.0.2, 35.1.1, and 32.0.1: Update to version 37.0.2, 35.1.1, or 32.0.1. As a workaround, update the logFormat variable to remove the X-Rucio-Auth-Token.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2025-54064

GHSA-CMFQ-F2V2-VJ33

Affected Products

Apache

Rucio-Server

Rucio-Ui

Rucio-Webui

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54064.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-54064 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54064 · Vendor Advisory
• https://github.com/rucio/helm-charts/security/advisories/GHSA-cmfq-f2v2-vj33 · Note
• https://t.me/cvetracker/28041 · Telegram Post
• https://twitter.com/CVEnew/status/1945860153112395852 · Twitter Post