Search criteria
10 vulnerabilities found for para by erudika
CVE-2025-49009 (GCVE-0-2025-49009)
Vulnerability from cvelistv5 – Published: 2025-06-05 16:40 – Updated: 2025-06-17 13:54
VLAI?
Title
Para Inserts Sensitive Information into Log File for Facebook authentication
Summary
Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 in `FacebookAuthFilter.java` results in a full request URL being logged during a failed request to a Facebook user profile. The log includes the user's access token in plain text. Since WARN-level logs are often retained in production and accessible to operators or log aggregation systems, this poses a risk of token exposure. Version 1.50.8 fixes the issue.
Severity ?
6.2 (Medium)
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-49009",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-17T13:54:10.822111Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-17T13:54:23.657Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "para",
"vendor": "Erudika",
"versions": [
{
"status": "affected",
"version": "\u003c 1.50.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 in `FacebookAuthFilter.java` results in a full request URL being logged during a failed request to a Facebook user profile. The log includes the user\u0027s access token in plain text. Since WARN-level logs are often retained in production and accessible to operators or log aggregation systems, this poses a risk of token exposure. Version 1.50.8 fixes the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-05T16:40:27.978Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Erudika/para/security/advisories/GHSA-qx7g-fx8q-545g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Erudika/para/security/advisories/GHSA-qx7g-fx8q-545g"
},
{
"name": "https://github.com/Erudika/para/commit/46a908d887da02037384193f70a69345f04887cf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Erudika/para/commit/46a908d887da02037384193f70a69345f04887cf"
}
],
"source": {
"advisory": "GHSA-qx7g-fx8q-545g",
"discovery": "UNKNOWN"
},
"title": "Para Inserts Sensitive Information into Log File for Facebook authentication"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-49009",
"datePublished": "2025-06-05T16:40:27.978Z",
"dateReserved": "2025-05-29T16:34:07.176Z",
"dateUpdated": "2025-06-17T13:54:23.657Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-48955 (GCVE-0-2025-48955)
Vulnerability from cvelistv5 – Published: 2025-06-02 11:11 – Updated: 2025-06-02 16:47
VLAI?
Title
Para Server Logs Sensitive Information
Summary
Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require logging for debugging or system health purposes. Version 1.50.8 fixes the issue.
Severity ?
6.2 (Medium)
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-48955",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-02T16:46:31.470097Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-02T16:47:02.156Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "para",
"vendor": "Erudika",
"versions": [
{
"status": "affected",
"version": "\u003c 1.50.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require logging for debugging or system health purposes. Version 1.50.8 fixes the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-02T11:11:22.722Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Erudika/para/security/advisories/GHSA-v75g-77vf-6jjq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Erudika/para/security/advisories/GHSA-v75g-77vf-6jjq"
},
{
"name": "https://github.com/Erudika/para/commit/1e8a89558542854bb0683ab234c4429ad93b0835",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Erudika/para/commit/1e8a89558542854bb0683ab234c4429ad93b0835"
}
],
"source": {
"advisory": "GHSA-v75g-77vf-6jjq",
"discovery": "UNKNOWN"
},
"title": "Para Server Logs Sensitive Information"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-48955",
"datePublished": "2025-06-02T11:11:22.722Z",
"dateReserved": "2025-05-28T18:49:07.585Z",
"dateUpdated": "2025-06-02T16:47:02.156Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-1848 (GCVE-0-2022-1848)
Vulnerability from cvelistv5 – Published: 2022-05-24 10:40 – Updated: 2024-08-03 00:17
VLAI?
Title
Business Logic Errors in erudika/para
Summary
Business Logic Errors in GitHub repository erudika/para prior to 1.45.11.
Severity ?
9 (Critical)
CWE
- CWE-840 - Business Logic Errors
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| erudika | erudika/para |
Affected:
unspecified , < 1.45.11
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:17:00.744Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/8dfe0877-e44b-4a1a-8eee-5c03c93ae90a"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/erudika/para/commit/fa677c629842df60099daa9c23bd802bc41b48d1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "erudika/para",
"vendor": "erudika",
"versions": [
{
"lessThan": "1.45.11",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Business Logic Errors in GitHub repository erudika/para prior to 1.45.11."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-840",
"description": "CWE-840 Business Logic Errors",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-24T10:40:09",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/8dfe0877-e44b-4a1a-8eee-5c03c93ae90a"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/erudika/para/commit/fa677c629842df60099daa9c23bd802bc41b48d1"
}
],
"source": {
"advisory": "8dfe0877-e44b-4a1a-8eee-5c03c93ae90a",
"discovery": "EXTERNAL"
},
"title": "Business Logic Errors in erudika/para",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2022-1848",
"STATE": "PUBLIC",
"TITLE": "Business Logic Errors in erudika/para"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "erudika/para",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "1.45.11"
}
]
}
}
]
},
"vendor_name": "erudika"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Business Logic Errors in GitHub repository erudika/para prior to 1.45.11."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-840 Business Logic Errors"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/8dfe0877-e44b-4a1a-8eee-5c03c93ae90a",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/8dfe0877-e44b-4a1a-8eee-5c03c93ae90a"
},
{
"name": "https://github.com/erudika/para/commit/fa677c629842df60099daa9c23bd802bc41b48d1",
"refsource": "MISC",
"url": "https://github.com/erudika/para/commit/fa677c629842df60099daa9c23bd802bc41b48d1"
}
]
},
"source": {
"advisory": "8dfe0877-e44b-4a1a-8eee-5c03c93ae90a",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2022-1848",
"datePublished": "2022-05-24T10:40:09",
"dateReserved": "2022-05-24T00:00:00",
"dateUpdated": "2024-08-03T00:17:00.744Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-1782 (GCVE-0-2022-1782)
Vulnerability from cvelistv5 – Published: 2022-05-18 09:00 – Updated: 2024-08-03 00:16
VLAI?
Title
Cross-site Scripting (XSS) - Generic in erudika/para
Summary
Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11.
Severity ?
9.4 (Critical)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| erudika | erudika/para |
Affected:
unspecified , < v1.45.11
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:16:59.850Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/7555693f-94e4-4183-98cb-3497da6df028"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/erudika/para/commit/9d844f31333475a0394dd14b901ea50674b281f8"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "erudika/para",
"vendor": "erudika",
"versions": [
{
"lessThan": "v1.45.11",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-18T09:00:14",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/7555693f-94e4-4183-98cb-3497da6df028"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/erudika/para/commit/9d844f31333475a0394dd14b901ea50674b281f8"
}
],
"source": {
"advisory": "7555693f-94e4-4183-98cb-3497da6df028",
"discovery": "EXTERNAL"
},
"title": "Cross-site Scripting (XSS) - Generic in erudika/para",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2022-1782",
"STATE": "PUBLIC",
"TITLE": "Cross-site Scripting (XSS) - Generic in erudika/para"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "erudika/para",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "v1.45.11"
}
]
}
}
]
},
"vendor_name": "erudika"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/7555693f-94e4-4183-98cb-3497da6df028",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/7555693f-94e4-4183-98cb-3497da6df028"
},
{
"name": "https://github.com/erudika/para/commit/9d844f31333475a0394dd14b901ea50674b281f8",
"refsource": "MISC",
"url": "https://github.com/erudika/para/commit/9d844f31333475a0394dd14b901ea50674b281f8"
}
]
},
"source": {
"advisory": "7555693f-94e4-4183-98cb-3497da6df028",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2022-1782",
"datePublished": "2022-05-18T09:00:14",
"dateReserved": "2022-05-18T00:00:00",
"dateUpdated": "2024-08-03T00:16:59.850Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-49009 (GCVE-0-2025-49009)
Vulnerability from nvd – Published: 2025-06-05 16:40 – Updated: 2025-06-17 13:54
VLAI?
Title
Para Inserts Sensitive Information into Log File for Facebook authentication
Summary
Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 in `FacebookAuthFilter.java` results in a full request URL being logged during a failed request to a Facebook user profile. The log includes the user's access token in plain text. Since WARN-level logs are often retained in production and accessible to operators or log aggregation systems, this poses a risk of token exposure. Version 1.50.8 fixes the issue.
Severity ?
6.2 (Medium)
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-49009",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-17T13:54:10.822111Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-17T13:54:23.657Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "para",
"vendor": "Erudika",
"versions": [
{
"status": "affected",
"version": "\u003c 1.50.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 in `FacebookAuthFilter.java` results in a full request URL being logged during a failed request to a Facebook user profile. The log includes the user\u0027s access token in plain text. Since WARN-level logs are often retained in production and accessible to operators or log aggregation systems, this poses a risk of token exposure. Version 1.50.8 fixes the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-05T16:40:27.978Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Erudika/para/security/advisories/GHSA-qx7g-fx8q-545g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Erudika/para/security/advisories/GHSA-qx7g-fx8q-545g"
},
{
"name": "https://github.com/Erudika/para/commit/46a908d887da02037384193f70a69345f04887cf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Erudika/para/commit/46a908d887da02037384193f70a69345f04887cf"
}
],
"source": {
"advisory": "GHSA-qx7g-fx8q-545g",
"discovery": "UNKNOWN"
},
"title": "Para Inserts Sensitive Information into Log File for Facebook authentication"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-49009",
"datePublished": "2025-06-05T16:40:27.978Z",
"dateReserved": "2025-05-29T16:34:07.176Z",
"dateUpdated": "2025-06-17T13:54:23.657Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-48955 (GCVE-0-2025-48955)
Vulnerability from nvd – Published: 2025-06-02 11:11 – Updated: 2025-06-02 16:47
VLAI?
Title
Para Server Logs Sensitive Information
Summary
Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require logging for debugging or system health purposes. Version 1.50.8 fixes the issue.
Severity ?
6.2 (Medium)
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-48955",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-02T16:46:31.470097Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-02T16:47:02.156Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "para",
"vendor": "Erudika",
"versions": [
{
"status": "affected",
"version": "\u003c 1.50.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require logging for debugging or system health purposes. Version 1.50.8 fixes the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-02T11:11:22.722Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Erudika/para/security/advisories/GHSA-v75g-77vf-6jjq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Erudika/para/security/advisories/GHSA-v75g-77vf-6jjq"
},
{
"name": "https://github.com/Erudika/para/commit/1e8a89558542854bb0683ab234c4429ad93b0835",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Erudika/para/commit/1e8a89558542854bb0683ab234c4429ad93b0835"
}
],
"source": {
"advisory": "GHSA-v75g-77vf-6jjq",
"discovery": "UNKNOWN"
},
"title": "Para Server Logs Sensitive Information"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-48955",
"datePublished": "2025-06-02T11:11:22.722Z",
"dateReserved": "2025-05-28T18:49:07.585Z",
"dateUpdated": "2025-06-02T16:47:02.156Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-1848 (GCVE-0-2022-1848)
Vulnerability from nvd – Published: 2022-05-24 10:40 – Updated: 2024-08-03 00:17
VLAI?
Title
Business Logic Errors in erudika/para
Summary
Business Logic Errors in GitHub repository erudika/para prior to 1.45.11.
Severity ?
9 (Critical)
CWE
- CWE-840 - Business Logic Errors
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| erudika | erudika/para |
Affected:
unspecified , < 1.45.11
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:17:00.744Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/8dfe0877-e44b-4a1a-8eee-5c03c93ae90a"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/erudika/para/commit/fa677c629842df60099daa9c23bd802bc41b48d1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "erudika/para",
"vendor": "erudika",
"versions": [
{
"lessThan": "1.45.11",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Business Logic Errors in GitHub repository erudika/para prior to 1.45.11."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-840",
"description": "CWE-840 Business Logic Errors",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-24T10:40:09",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/8dfe0877-e44b-4a1a-8eee-5c03c93ae90a"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/erudika/para/commit/fa677c629842df60099daa9c23bd802bc41b48d1"
}
],
"source": {
"advisory": "8dfe0877-e44b-4a1a-8eee-5c03c93ae90a",
"discovery": "EXTERNAL"
},
"title": "Business Logic Errors in erudika/para",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2022-1848",
"STATE": "PUBLIC",
"TITLE": "Business Logic Errors in erudika/para"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "erudika/para",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "1.45.11"
}
]
}
}
]
},
"vendor_name": "erudika"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Business Logic Errors in GitHub repository erudika/para prior to 1.45.11."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-840 Business Logic Errors"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/8dfe0877-e44b-4a1a-8eee-5c03c93ae90a",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/8dfe0877-e44b-4a1a-8eee-5c03c93ae90a"
},
{
"name": "https://github.com/erudika/para/commit/fa677c629842df60099daa9c23bd802bc41b48d1",
"refsource": "MISC",
"url": "https://github.com/erudika/para/commit/fa677c629842df60099daa9c23bd802bc41b48d1"
}
]
},
"source": {
"advisory": "8dfe0877-e44b-4a1a-8eee-5c03c93ae90a",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2022-1848",
"datePublished": "2022-05-24T10:40:09",
"dateReserved": "2022-05-24T00:00:00",
"dateUpdated": "2024-08-03T00:17:00.744Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-1782 (GCVE-0-2022-1782)
Vulnerability from nvd – Published: 2022-05-18 09:00 – Updated: 2024-08-03 00:16
VLAI?
Title
Cross-site Scripting (XSS) - Generic in erudika/para
Summary
Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11.
Severity ?
9.4 (Critical)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| erudika | erudika/para |
Affected:
unspecified , < v1.45.11
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:16:59.850Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/7555693f-94e4-4183-98cb-3497da6df028"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/erudika/para/commit/9d844f31333475a0394dd14b901ea50674b281f8"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "erudika/para",
"vendor": "erudika",
"versions": [
{
"lessThan": "v1.45.11",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-18T09:00:14",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/7555693f-94e4-4183-98cb-3497da6df028"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/erudika/para/commit/9d844f31333475a0394dd14b901ea50674b281f8"
}
],
"source": {
"advisory": "7555693f-94e4-4183-98cb-3497da6df028",
"discovery": "EXTERNAL"
},
"title": "Cross-site Scripting (XSS) - Generic in erudika/para",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2022-1782",
"STATE": "PUBLIC",
"TITLE": "Cross-site Scripting (XSS) - Generic in erudika/para"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "erudika/para",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "v1.45.11"
}
]
}
}
]
},
"vendor_name": "erudika"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/7555693f-94e4-4183-98cb-3497da6df028",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/7555693f-94e4-4183-98cb-3497da6df028"
},
{
"name": "https://github.com/erudika/para/commit/9d844f31333475a0394dd14b901ea50674b281f8",
"refsource": "MISC",
"url": "https://github.com/erudika/para/commit/9d844f31333475a0394dd14b901ea50674b281f8"
}
]
},
"source": {
"advisory": "7555693f-94e4-4183-98cb-3497da6df028",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2022-1782",
"datePublished": "2022-05-18T09:00:14",
"dateReserved": "2022-05-18T00:00:00",
"dateUpdated": "2024-08-03T00:16:59.850Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
FKIE_CVE-2022-1848
Vulnerability from fkie_nvd - Published: 2022-05-24 13:15 - Updated: 2024-11-21 06:41
Severity ?
Summary
Business Logic Errors in GitHub repository erudika/para prior to 1.45.11.
References
| URL | Tags | ||
|---|---|---|---|
| security@huntr.dev | https://github.com/erudika/para/commit/fa677c629842df60099daa9c23bd802bc41b48d1 | Patch, Third Party Advisory | |
| security@huntr.dev | https://huntr.dev/bounties/8dfe0877-e44b-4a1a-8eee-5c03c93ae90a | Exploit, Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/erudika/para/commit/fa677c629842df60099daa9c23bd802bc41b48d1 | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://huntr.dev/bounties/8dfe0877-e44b-4a1a-8eee-5c03c93ae90a | Exploit, Patch, Third Party Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:erudika:para:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9681E6A4-3CDB-4FE4-958A-136719A981BE",
"versionEndExcluding": "1.45.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Business Logic Errors in GitHub repository erudika/para prior to 1.45.11."
},
{
"lang": "es",
"value": "Unos Errores de L\u00f3gica de Negocio en el repositorio GitHub erudika/para versiones anteriores a 1.45.11"
}
],
"id": "CVE-2022-1848",
"lastModified": "2024-11-21T06:41:36.150",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 6.0,
"source": "security@huntr.dev",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-05-24T13:15:07.683",
"references": [
{
"source": "security@huntr.dev",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/erudika/para/commit/fa677c629842df60099daa9c23bd802bc41b48d1"
},
{
"source": "security@huntr.dev",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "https://huntr.dev/bounties/8dfe0877-e44b-4a1a-8eee-5c03c93ae90a"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/erudika/para/commit/fa677c629842df60099daa9c23bd802bc41b48d1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "https://huntr.dev/bounties/8dfe0877-e44b-4a1a-8eee-5c03c93ae90a"
}
],
"sourceIdentifier": "security@huntr.dev",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-840"
}
],
"source": "security@huntr.dev",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2022-1782
Vulnerability from fkie_nvd - Published: 2022-05-18 15:15 - Updated: 2024-11-21 06:41
Severity ?
Summary
Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11.
References
| URL | Tags | ||
|---|---|---|---|
| security@huntr.dev | https://github.com/erudika/para/commit/9d844f31333475a0394dd14b901ea50674b281f8 | Patch, Third Party Advisory | |
| security@huntr.dev | https://huntr.dev/bounties/7555693f-94e4-4183-98cb-3497da6df028 | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/erudika/para/commit/9d844f31333475a0394dd14b901ea50674b281f8 | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://huntr.dev/bounties/7555693f-94e4-4183-98cb-3497da6df028 | Exploit, Third Party Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:erudika:para:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9681E6A4-3CDB-4FE4-958A-136719A981BE",
"versionEndExcluding": "1.45.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross-site Scripting (XSS) - Gen\u00e9rico en el repositorio de GitHub erudika/para versiones anteriores a v1.45.11"
}
],
"id": "CVE-2022-1782",
"lastModified": "2024-11-21T06:41:27.470",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.5,
"source": "security@huntr.dev",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-05-18T15:15:08.837",
"references": [
{
"source": "security@huntr.dev",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/erudika/para/commit/9d844f31333475a0394dd14b901ea50674b281f8"
},
{
"source": "security@huntr.dev",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://huntr.dev/bounties/7555693f-94e4-4183-98cb-3497da6df028"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/erudika/para/commit/9d844f31333475a0394dd14b901ea50674b281f8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://huntr.dev/bounties/7555693f-94e4-4183-98cb-3497da6df028"
}
],
"sourceIdentifier": "security@huntr.dev",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "security@huntr.dev",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}