GitHub Advisoryadvisory · Maven

GHSA-cqm8-rg2p-jfcf Infinispan CLI vulnerable to Generation of Error Message Containing Sensitive Information

MEDIUM Published 2025-06-27 Modified 2026-01-08 Official page ↗
Aliases
CVE-2025-5731
Ecosystem
Maven
Packages
org.infinispan:infinispan-cli-client
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-209
Reviewed
2025-06-27

Affected packages

• Maven org.infinispan:infinispan-cli-client: <= 16.0.0.Dev01 (no fix yet)

Description

A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.

Related

Alias · CVE (1)

  • CVE-2025-5731 A flaw was found in Infinispan CLI. vulnerability

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References