{"answers":{"affected":"2 open source packages ship an affected version, including com.erudika:para-server.","exploited":"There is no known exploitation of CVE-2025-49009 in the wild and no public exploit code.","fix":"Upgrade com.erudika:para-server to 1.50.8 or later.","what":"CVE-2025-49009 is a medium-severity vulnerability in Erudika para, published on 5 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-49009 and fix it if it is affected.\n\nWhat it is: CVE-2025-49009 is a medium-severity vulnerability in Erudika para, published on 5 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-49009 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- com.erudika:para-server (Maven): affected all versions; fixed in 1.50.8\n- com.erudika:para-server (Maven): affected all versions; fixed in 1.50.8\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-49009/ (Markdown: https://insights.sbomify.com/CVE-2025-49009/index.md)","id":"CVE-2025-49009","markdown":"https://insights.sbomify.com/CVE-2025-49009/index.md","name":"CVE-2025-49009","record":{"aliases":["GHSA-qx7g-fx8q-545g"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Para backend framework","requires_auth":"none","summary":"Attackers with log access can steal Facebook access tokens due to sensitive data being logged in plain text during authentication failures.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":6.2,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-532","name":"Insertion of Sensitive Information into Log File"}],"description":"Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 in `FacebookAuthFilter.java` results in a full request URL being logged during a failed request to a Facebook user profile. The log includes the user's access token in plain text. Since WARN-level logs are often retained in production and accessible to operators or log aggregation systems, this poses a risk of token exposure. Version 1.50.8 fixes the issue.","ecosystems":["Maven"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Para Inserts Sensitive Information into Log File for Facebook authentication","id":"CVE-2025-49009","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Maven","product":null,"products":[],"type":"information_disclosure","year":"2025"},"n_packages":2,"n_references":2,"next":{"headline":"OpenSC: Stack-buffer-overflow WRITE in GET RESPONSE","id":"CVE-2025-49010"},"packages":[{"ecosystem":"Maven","fixed":["1.50.8"],"introduced":["0"],"last_affected":[],"package":"com.erudika:para-server","purl":null,"source":"GHSA-qx7g-fx8q-545g"},{"ecosystem":"Maven","fixed":["1.50.8"],"introduced":["0"],"last_affected":[],"package":"com.erudika:para-server","purl":"pkg:maven/com.erudika/para-server","source":"GHSA-qx7g-fx8q-545g"}],"prev":{"headline":"Atheos Improper Input Validation Vulnerability Enables RCE in Common.php","id":"CVE-2025-49008"},"products":["para"],"published":"2025-06-05","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-06-17","vendors":["Erudika"]},"summary":"Attackers with log access can steal Facebook access tokens due to sensitive data being logged in plain text during authentication failures.","url":"https://insights.sbomify.com/CVE-2025-49009/"}