CVE-2022-25512 Exposure of Sensitive Information to an Unauthorized Actor in FreeTAKServer-UI
FreeTAKServer-UI leaks sensitive API and Websocket keys, allowing attackers to bypass security controls and access protected data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-25512?
CVE-2022-25512 is a high-severity vulnerability in n/a, published on 10 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys.
Weakness: CWE-200
Which versions are affected by CVE-2022-25512?
3 open source packages ship an affected version, including freetakserver-ui and FreeTAKServer-UI. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
freetakserver-ui PyPI | All versions to 1.9.8 | None |
freetakserver-ui PyPI | All versions to 1.9.8 | None |
FreeTAKServer-UI PyPI | All versions to 1.9.8 | None |
Products include Freetakserver-Ui Project Freetakserver-Ui.
How do I fix CVE-2022-25512?
No fix has been published for CVE-2022-25512 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-25512 being exploited?
There is no known exploitation of CVE-2022-25512 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-9988-f88m-mr42, PYSEC-2026-638.