CVE-2025-25013

{"id": "CVE-2025-25013", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "bressers@elastic.co", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2025-04-08T23:15:45.540", "references": [{"url": "https://discuss.elastic.co/t/elastic-defend-8-17-3-security-update-esa-2025-05/376921", "source": "bressers@elastic.co"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "bressers@elastic.co", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens via automatic transmission of unfiltered environment variables to the stack."}, {"lang": "es", "value": "La restricci\u00f3n incorrecta de las variables de entorno en Elastic Defend puede provocar la exposici\u00f3n de informaci\u00f3n confidencial, como claves API y tokens, a trav\u00e9s de la transmisi\u00f3n autom\u00e1tica de variables de entorno sin filtrar a la pila."}], "lastModified": "2025-04-09T20:02:41.860", "sourceIdentifier": "bressers@elastic.co"}