CVE-2025-1395

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-1395 is a Generation of Error Message Containing Sensitive Information vulnerability (CWE-209) in HeyGarson, a product from Codriapp Innovation and Software Technologies Inc. The flaw enables fuzzing for application mapping by leaking sensitive details through error messages. It affects all versions of HeyGarson through 30012026. The vulnerability received a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to its network accessibility, low complexity, and lack of required privileges or user interaction.

Remote, unauthenticated attackers can exploit this vulnerability over the network by sending crafted fuzzing inputs to the affected HeyGarson application. Successful exploitation allows attackers to map the application's structure and extract sensitive information from error responses, achieving high confidentiality impact through information disclosure and low integrity impact, potentially aiding further attacks like reconnaissance for targeted exploits.

The primary advisory is available at https://www.usom.gov.tr/bildirim/tr-26-0009. No patches or vendor fixes are confirmed, as the vendor was contacted multiple times to verify the fixing process but did not respond. Security practitioners should isolate or discontinue use of affected HeyGarson instances until further mitigation details emerge.