{"id":"CVE-2025-5731","state":"PUBLISHED","title":"Infinispan: credential leakage in infinispan cli","description":"A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.","publishedAt":"2025-06-26T21:28:59.501Z","updatedAt":"2026-01-08T03:11:10.828Z","severity":{"score":5.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"redhat"},"assigner":"redhat","products":["Red Hat infinispan","Red Hat Red Hat Data Grid 8.5.4","Red Hat Red Hat JBoss Enterprise Application Platform 7","Red Hat Red Hat JBoss Enterprise Application Platform 8","Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack"],"affected":[{"vendor":"Red Hat","product":"infinispan","packageName":"infinispan","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"15.2.5","versionType":"semver"}],"collectionURL":"https://github.com/infinispan/infinispan"},{"vendor":"Red Hat","product":"Red Hat Data Grid 8.5.4","packageName":"infinispan-cli-client","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_data_grid:8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"infinispan-cli-client","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"infinispan-cli-client","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"infinispan-cli-client","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jbosseapxp"]}],"references":["https://access.redhat.com/errata/RHSA-2025:10130","https://access.redhat.com/security/cve/CVE-2025-5731","https://bugzilla.redhat.com/show_bug.cgi?id=2370429"],"weaknesses":["CWE-209"],"ingestedAt":"2026-10-29T20:09:39.787Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/5xxx/CVE-2025-5731.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-5731","state":"PUBLISHED","datePublished":"2025-06-26T21:28:59.501Z","dateUpdated":"2026-01-08T03:11:10.828Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2025-06-05T13:48:09.202Z"},"containers":{"cna":{"title":"Infinispan: credential leakage in infinispan cli","descriptions":[{"lang":"en","value":"A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found."}],"affected":[{"vendor":"Red Hat","product":"infinispan","packageName":"infinispan","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"15.2.5","versionType":"semver"}],"collectionURL":"https://github.com/infinispan/infinispan"},{"vendor":"Red Hat","product":"Red Hat Data Grid 8.5.4","packageName":"infinispan-cli-client","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_data_grid:8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"infinispan-cli-client","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"infinispan-cli-client","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"infinispan-cli-client","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jbosseapxp"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:10130","name":"RHSA-2025:10130","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-5731","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2370429","name":"RHBZ#2370429","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-209","description":"Generation of Error Message Containing Sensitive Information","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-01-08T03:11:10.828Z"},"datePublic":"2025-06-26T21:24:21.857Z","x_redhatCweChain":"CWE-209: Generation of Error Message Containing Sensitive Information","workarounds":[{"lang":"en","value":"Currently, no mitigation is available for this vulnerability."}],"timeline":[{"lang":"en","time":"2025-06-05T13:42:15.727Z","value":"Reported to Red Hat."},{"lang":"en","time":"2025-06-26T21:24:21.857Z","value":"Made public."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-06-27T13:13:26.599882Z","id":"CVE-2025-5731","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-27T13:13:36.582Z"}}]}}}