PT-2025-44457 · Apache · Apache Apisix

Published 2025-10-30 · Updated 2025-11-06 · CVE-2025-62232

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache APISIX versions prior to 3.14

Description A flaw exists where sensitive data, specifically usernames and passwords used in basic authentication, are exposed through logging. When the log level is set to INFO or DEBUG, these credentials are written in plaintext to error logs and subsequently forwarded to log sinks, potentially leading to credential compromise if log access is unauthorized.

Recommendations Upgrade to version 3.14 or later to address this issue.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BIT-APISIX-2025-62232

CVE-2025-62232

Affected Products

Apache Apisix

References · 11

• https://osv.dev/vulnerability/BIT-apisix-2025-62232 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62232 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62232 · Vendor Advisory
• https://github.com/apache/apisix · Note
• https://t.me/cveNotify/141090 · Telegram Post
• https://lists.apache.org/thread/32hdgh570btfhg02hfc7p7ckf9v83259 · Vendor Advisory, Patch
• https://twitter.com/oss_security/status/1983938576917090322 · Twitter Post
• https://twitter.com/CVEnew/status/1984194023272427707 · Twitter Post
• https://t.me/CVEtracker/36274 · Telegram Post
• http://openwall.com/lists/oss-security/2025/10/30/4 · Note
• https://t.me/cveNotify/141803 · Telegram Post