PT-2025-50352 · Pagerduty · Pagerduty Runbook

Published 2025-12-10 · Updated 2026-01-02 · CVE-2025-52493

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PagerDuty Runbook versions through 2025-06-12

Description PagerDuty Runbook through 2025-06-12 has an issue where stored secrets are exposed directly in the webpage Document Object Model (DOM) at the configuration page. While these secrets are displayed as masked password fields, the actual secret values are present in the page source. An attacker with administrative access to the configuration page can reveal the secret values by modifying the input field type from "password" to "text" using browser developer tools.

Recommendations Versions through 2025-06-12 should be updated. As a temporary workaround, restrict access to the configuration page to authorized personnel only.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-52493

Affected Products

Pagerduty Runbook

References · 8

• 🔥 https://github.com/carterross2/Vulnerability-Research/tree/main/CVE-2025-52493 · Exploit
• https://osv.dev/vulnerability/CVE-2025-52493 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52493 · Security Note
• https://pagerduty.com/security/disclosure · Note
• https://praetorian.com · Note
• https://pagerduty.com/platform/automation · Note
• https://twitter.com/CVEnew/status/2000248648140235254 · Twitter Post
• https://t.me/cveNotify/147515 · Telegram Post