CVE-2025-26013
Published: 21 February 2025
Summary
CVE-2025-26013 is a high-severity Inclusion of Sensitive Information in Source Code (CWE-540) vulnerability in Olajowon Loggrove. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AU-13 (Monitoring for Information Disclosure).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the information disclosure flaw in the read.py component of Loggrove v1.0 by identifying, reporting, and correcting the vulnerability.
Enforces approved authorizations for access to sensitive information, preventing remote attackers from exploiting the read.py component without privileges.
Monitors system components for indications of information disclosure, enabling detection of exploitation attempts via the read.py vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated information disclosure in a public-facing Loggrove service directly enables initial access via exploitation of an exposed application.
NVD Description
An issue in Loggrove v.1.0 allows a remote attacker to obtain sensitive information via the read.py component.
Deeper analysisAI
CVE-2025-26013 is an information disclosure vulnerability in Loggrove version 1.0, specifically within the read.py component. Published on 2025-02-21, the issue enables a remote attacker to obtain sensitive information. It carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) and is classified under CWE-540.
The vulnerability can be exploited by any remote attacker over the network, requiring low attack complexity, no privileges, and no user interaction. Successful exploitation grants high-impact access to sensitive information, with a low integrity impact but no effect on availability.
Mitigation details are available in the referenced advisory at https://gitee.com/olajowon/loggrove/issues/IBJSXS.
Details
- CWE(s)