PT-2025-36399 · Atlantis · Atlantis

Matthewmrichter · Published 2025-09-05 · Updated 2025-09-22 · CVE-2025-58445

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Atlantis (affected versions not specified)

Description Atlantis, a self-hosted golang application that listens for Terraform pull request events via webhooks, exposes detailed version information through the /status endpoint. This information disclosure could allow attackers to identify and target known issues associated with specific versions, potentially compromising the service's security.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-58445

GHSA-XH7V-965R-23F7

GO-2025-3940

OPENSUSE-SU-2025:15564-1

SUSE-SU-2025:03289-1

Affected Products

Atlantis

References · 49

• 🔥 https://github.com/runatlantis/atlantis/security/advisories/GHSA-xh7v-965r-23f7 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58445.json · Exploit
• https://osv.dev/vulnerability/GHSA-xh7v-965r-23f7 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3940 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58445 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58445 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:03289-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15564-1 · Vendor Advisory
• https://github.com/runatlantis/atlantis · Note
• https://suse.com/security/cve/CVE-2025-54376 · Note
• https://suse.com/security/cve/CVE-2025-58430 · Note
• https://suse.com/security/cve/CVE-2025-58437 · Note
• https://suse.com/security/cve/CVE-2025-8396 · Note
• https://suse.com/security/cve/CVE-2025-58158 · Note
• https://suse.com/security/cve/CVE-2025-55190 · Note