PT-2025-53656 · Halo · Halo

Vuldb + 1 · Published 2025-12-28 · Updated 2026-02-19 · CVE-2025-15141

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Halo versions up to 2.21.10

Description A flaw exists in Halo, specifically within the Configuration Handler component. This issue involves the processing of the /actuator file and can lead to information disclosure. The attack can be carried out remotely and is considered to be of high complexity with difficult exploitability. The exploit for this issue has been publicly disclosed. The vendor was informed about the disclosure but did not provide a response.

API Endpoints /actuator

Recommendations Versions prior to 2.21.10 should be updated. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Information Disclosure

Weakness Enumeration

CWE-284

CWE-200

Related Identifiers

CVE-2025-15141

Affected Products

Halo

References · 11

• 🔥 https://github.com/SECWG/cve/issues/9 · Exploit
• https://osv.dev/vulnerability/CVE-2025-15141 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15141 · Security Note
• https://t.me/cveNotify/146980 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2005301426705043661 · Twitter Post
• https://t.me/CVEtracker/40777 · Telegram Post
• https://vuldb.com/?id.338519 · Note
• https://vuldb.com/?ctiid.338519 · Note
• https://vuldb.com/?submit.715235 · Note
• https://t.me/cveNotify/152458 · Telegram Post
• https://twitter.com/CVEnew/status/2005301345365196955 · Twitter Post