CVE-2025-58584
Sick Baggage Analytics
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2025-58584 is a medium-severity Use of HTTP Request With Sensitive Query String (CWE-598) vulnerability in Sick Baggage Analytics. Its CVSS base score is 5.3 (Medium).
Operationally, ranked at the 29th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-8 (Transmission Confidentiality and Integrity) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-32193
Vulnerability Data
In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be stored in various systems such as server logs, browser histories or proxy servers. As a result, there is a high…
more
risk that this sensitive data will be disclosed unintentionally.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Requires confidentiality protection for all transmitted information, directly precluding the inclusion of credentials in URLs that are visible to logs, proxies and browser history.
Mandates secure authenticator management and transmission practices, eliminating the use of GET parameters for passwords and usernames.
Requires approved remote-access methods that enforce secure credential handling rather than URL-based transmission.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent embedding sensitive data in query strings as part of input-handling and data-flow design.
HTTPS encryption protects query strings in transit but does not address the root design flaw of placing sensitive data in URLs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect sensitive data leakage via query strings.
DLP solutions can detect and block sensitive data in URLs.
Network security controls can enforce HTTPS and block sensitive data in URLs.
Application security requirements should mandate avoiding sensitive data in query strings.
Secure architecture principles discourage exposing sensitive data in URLs.
Secure coding standards directly prohibit placing secrets in query parameters.