CVE-2025-57564
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NSummary
CVE-2025-57564 is a high-severity Improper Output Neutralization for Logs (CWE-117) vulnerability. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Indicator Removal (T1070); ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-57564 is an unauthenticated log injection vulnerability in the CubeAPM platform, specifically the nightly-2025-08-01-1 build, though the issue exists in the core platform across deployments. The vulnerable /api/logs/insert/elasticsearch/_bulk endpoint accepts bulk log data without authentication or input validation, enabling remote attackers to inject arbitrary log entries into production systems. This flaw, published on 2025-10-07, carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) and is classified under CWE-117.
Unauthenticated attackers with network access can exploit this endpoint remotely with low complexity and no privileges required. Exploitation allows injection of false log entries, leading to log poisoning, obfuscation of security alerts, and potential performance degradation in the observability pipeline.
Advisories and additional details are available in the provided references: https://github.com/prassan10/CubeAPM/blob/main/CVE-2025-57564%3A%20Unauthenticated%20Log%20Injection%20in%20CubeAPM and https://github.com/prassan10/CubeAPM/blob/main/Unauthenticated-Log_Injection.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-32060
Vulnerability Data
CubeAPM nightly-2025-08-01-1 allow unauthenticated attackers to inject arbitrary log entries into production systems via the /api/logs/insert/elasticsearch/_bulk endpoint. This endpoint accepts bulk log data without requiring authentication or input validation, allowing remote attackers to perform unauthorized log injection. Exploitation may lead…
more
to false log entries, log poisoning, alert obfuscation, and potential performance degradation of the observability pipeline. The issue is present in the core CubeAPM platform and is not limited to specific deployment configurations.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing or incorrect output neutralization when log messages are constructed from untrusted input.
Input validation reduces the chance that specially crafted data reaches log-message construction routines.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices and coding standards directly require output sanitization for logs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect log injection flaws but does not prevent them at the source.
Logging control directly requires proper log generation and handling, which mitigates improper output neutralization.
Monitoring activities rely on trustworthy logs but do not ensure log message integrity.
Secure SDLC includes coding standards that reduce log-related weaknesses but does not specifically address logging.
Secure coding practices mandate input validation and output encoding, directly preventing log injection.