{"answers":{"affected":"2 open source packages ship an affected version, including com.erudika:para-server.","exploited":"There is no known exploitation of CVE-2025-48955 in the wild and no public exploit code.","fix":"Upgrade com.erudika:para-server to 1.50.8 or later.","what":"CVE-2025-48955 is a medium-severity vulnerability in Erudika para, published on 2 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-48955 and fix it if it is affected.\n\nWhat it is: CVE-2025-48955 is a medium-severity vulnerability in Erudika para, published on 2 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-48955 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- com.erudika:para-server (Maven): affected all versions; fixed in 1.50.8\n- com.erudika:para-server (Maven): affected all versions; fixed in 1.50.8\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-48955/ (Markdown: https://insights.sbomify.com/CVE-2025-48955/index.md)","id":"CVE-2025-48955","markdown":"https://insights.sbomify.com/CVE-2025-48955/index.md","name":"CVE-2025-48955","record":{"aliases":["GHSA-v75g-77vf-6jjq"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Para backend server","requires_auth":"none","summary":"Attackers with log access can retrieve exposed access and secret keys, compromising backend security.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":6.2,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-532","name":"Insertion of Sensitive Information into Log File"}],"description":"Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require logging for debugging or system health purposes. Version 1.50.8 fixes the issue.","ecosystems":["Maven"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Para Server Logs Sensitive Information","id":"CVE-2025-48955","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Maven","product":null,"products":[],"type":"information_disclosure","year":"2025"},"n_packages":2,"n_references":2,"next":{"headline":"vLLM API endpoints vulnerable to Denial of Service Attacks","id":"CVE-2025-48956"},"packages":[{"ecosystem":"Maven","fixed":["1.50.8"],"introduced":["0"],"last_affected":[],"package":"com.erudika:para-server","purl":null,"source":"GHSA-v75g-77vf-6jjq"},{"ecosystem":"Maven","fixed":["1.50.8"],"introduced":["0"],"last_affected":[],"package":"com.erudika:para-server","purl":"pkg:maven/com.erudika/para-server","source":"GHSA-v75g-77vf-6jjq"}],"prev":{"headline":"Discourse vulnerable to XSS via user-provided query parameter in oauth failure flow","id":"CVE-2025-48954"},"products":["para"],"published":"2025-06-02","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-06-02","vendors":["Erudika"]},"summary":"Attackers with log access can retrieve exposed access and secret keys, compromising backend security.","url":"https://insights.sbomify.com/CVE-2025-48955/"}