PT-2025-37098 · Hoverfly · Hoverfly

Kr1Shna4Garwal · Published 2025-09-10 · Updated 2025-09-24 · CVE-2025-54376

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Hoverfly versions 1.11.3 and prior

Description: Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs lacks the authentication middleware present in the REST admin API. This allows an unauthenticated remote attacker to stream real-time application logs, potentially exposing sensitive data such as internal file paths and request/response bodies.

Recommendations: Update to version 1.12.0 or later.

Exploit

Fix

Insertion into Log File

Information Disclosure

Improper Authentication

Weakness Enumeration

CWE-532

CWE-200

CWE-287

Related Identifiers

CVE-2025-54376

GHSA-JXMR-2H4Q-RHXP

GO-2025-3945

OPENSUSE-SU-2025:15564-1

SUSE-SU-2025:03289-1

Affected Products

Hoverfly

References · 51

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54376.json · Exploit
• https://github.com/SpectoLabs/hoverfly/commit/ffc2cc34563de67fe1a04f7ba5d78fa2d4564424 · Patch
• https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-jxmr-2h4q-rhxp · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jxmr-2h4q-rhxp · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3945 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15564-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03289-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54376 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54376 · Security Note
• https://github.com/SpectoLabs/hoverfly · Note
• https://suse.com/security/cve/CVE-2025-8077 · Note
• https://suse.com/security/cve/CVE-2025-58450 · Note
• https://suse.com/security/cve/CVE-2025-9566 · Note
• https://twitter.com/VulmonFeeds/status/1965888970975252683 · Twitter Post
• https://suse.com/security/cve/CVE-2025-54123 · Note