CVE-2025-43201

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-43201", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2025-04-16T15:24:37.088Z", "datePublished": "2025-08-15T21:58:14.676Z", "dateUpdated": "2026-04-02T18:24:34.748Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "An app may be able to unexpectedly leak a user's credentials"}]}], "affected": [{"vendor": "Apple", "product": "Apple Music Classical", "versions": [{"version": "0", "status": "affected", "lessThan": "2.3", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "This issue was addressed with improved checks. This issue is fixed in Apple Music Classical 2.3 for Android. An app may be able to unexpectedly leak a user's credentials."}], "references": [{"url": "https://support.apple.com/en-us/124156"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-04-02T18:24:34.748Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-08-18T12:27:43.188262Z", "id": "CVE-2025-43201", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-18T12:31:01.332Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-43201", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-18T12:27:43.188262Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-18T12:30:55.944Z"}}], "cna": {"affected": [{"vendor": "Apple", "product": "Apple Music Classical for Android", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "2.3", "versionType": "custom"}]}], "references": [{"url": "https://support.apple.com/en-us/124156"}], "descriptions": [{"lang": "en", "value": "This issue was addressed with improved checks. This issue is fixed in Apple Music Classical 2.3 for Android. An app may be able to unexpectedly leak a user's credentials."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "An app may be able to unexpectedly leak a user's credentials"}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2025-08-21T00:27:22.341Z"}}}, "cveMetadata": {"cveId": "CVE-2025-43201", "state": "PUBLISHED", "dateUpdated": "2025-08-21T00:27:22.341Z", "dateReserved": "2025-04-16T15:24:37.088Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2025-08-15T21:58:14.676Z", "assignerShortName": "apple"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Apple Music Classical", "vendor": "Apple", "versions": [{"lessThan": "2.3", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "product-security@apple.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apple:music_classical:*:*:*:*:*:android:*:*", "matchCriteriaId": "4BD3615B-5A4F-4188-869B-601C1FAC6CC5", "versionEndExcluding": "2.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This issue was addressed with improved checks. This issue is fixed in Apple Music Classical 2.3 for Android. An app may be able to unexpectedly leak a user's credentials."}, {"lang": "es", "value": "Este problema se solucion\u00f3 mejorando las comprobaciones. Este problema se solucion\u00f3 en Apple Music Classical 2.3 para Android. Una app podr\u00eda filtrar inesperadamente las credenciales de un usuario."}], "id": "CVE-2025-43201", "lastModified": "2026-06-17T09:23:28.627", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-43201", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-18T12:27:43.188262Z", "version": "2.0.3"}}]}, "published": "2025-08-15T22:15:31.930", "references": [{"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/en-us/124156"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T00:28:49.792289+00:00", "value": {"mitigation_remediation": ["Update Apple Music Classical to version 2.3 or later on all Android devices.", "Remove any credentials that may have been exposed by clearing the app\u2019s stored data via the device\u2019s credential manager.", "If an immediate update is not feasible, isolate the application by restricting its network access or using a mobile device management policy until the vulnerability is patched."], "summary": {"action": "Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "The affected product is Apple Music Classical running on Android devices. Only versions before 2.3 are vulnerable; the fix is contained in Apple Music Classical 2.3 and later. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog and the EPSS indicates a very low, but non\u2011zero, exploitation probability.", "description_and_impact": "Apple Music Classical for Android versions prior to 2.3 contain a flaw that may cause the application to leak a user's credentials unexpectedly. The vulnerability is described as an information disclosure flaw, allowing an attacker to gain unauthorized access to stored authentication data. Crucially, the disclosed data could be used to impersonate the user or gain further access to other services the credentials authorize.", "risk_and_exploitability": "The CVSS score of 6.2 indicates moderate severity. The very low EPSS (<1%) suggests that exploitation is unlikely under normal conditions, yet the possibility exists for targeted attacks. As no remedy or workaround is advertised by Apple, the primary mitigation is to upgrade to a fixed version. The absence from KEV indicates no known active exploitation, but caution is advised as credential leakage can enable further attacks."}}}}, "created": "2025-08-16T21:40:40.706506+00:00", "title": "Apple Music Classical Android May Leak Credentials", "updated": "2026-04-28T00:30:15.465889+00:00", "vendors": ["apple", "apple$PRODUCT$apple_music", "apple$PRODUCT$music", "google", "google$PRODUCT$android"]}