CVEvulnerability
CVE-2025-52493
6.5 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2025-12-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-200
Description
PagerDuty Runbook through 2025-06-12 exposes stored secrets directly in the webpage DOM at the configuration page. Although these secrets appear masked as password fields, the actual secret values are present in the page source and can be revealed by simply modifying the input field type from "password" to "text" using browser developer tools. This vulnerability is exploitable by administrative users who have access to the configuration page.
Affected configurations
• pagerduty runbook automation (<= 2025-06-12)
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://github.com/carterross2/Vulnerability-Research/tree/main/CVE-2025-52493 Third Party Advisory
- https://www.pagerduty.com/platform/automation/ Product
- https://www.pagerduty.com/security/disclosure/ Product
- https://www.praetorian.com Not Applicable