Sensitive Data Exposure in Para Multitenant Backend Server by Erudika
CVE-2025-48955

6.2MEDIUM

Key Information:

Vendor

Erudika

Status
Para
Vendor
CVE Published:
2 June 2025

What is CVE-2025-48955?

A flaw in the Para multitenant backend server allows for the exposure of sensitive access and secret keys in logs prior to version 1.50.8. This vulnerability permits the unredacted logging of credentials that are reused in variable assignments, potentially leading to unauthorized access. The issue has been addressed in version 1.50.8, which mitigates the risk of sensitive data being improperly logged and enables more secure key management practices.

Affected Version(s)

para < 1.50.8

References

https://github.com/Erudika/para/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/Erudika/para/commit/1e8a89558542854bb0...
x_refsource_MISC

CVSS V3.1

Score:
6.2
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.