CVE-2025-5141

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-5141", "assignerOrgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "state": "PUBLISHED", "assignerShortName": "Fortra", "dateReserved": "2025-05-23T21:18:11.239Z", "datePublished": "2025-06-17T19:30:51.781Z", "dateUpdated": "2025-08-29T20:11:13.423Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Linux", "AIX", "Solaris"], "product": "Core Privileged Access Manager (BoKS)", "vendor": "Fortra", "versions": [{"lessThanOrEqual": "7.2.0.17", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThanOrEqual": "8.1.0.22", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThanOrEqual": "8.1.1.7", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThanOrEqual": "9.0.0.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Maciej Grabiec, ING Hubs Poland"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager (BoKS) on versions 7.2.0 (up to 7.2.0.17), 8.1.0 (up to 8.1.0.22), 8.1.1 (up to 8.1.1.7), 9.0.0 (up to 9.0.0.1) and also legacy tar installs of BoKS 7.2 without hotfix #0474 on Linux, AIX, and Solaris allows low privilege local users to dump data from the cache."}], "value": "A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager (BoKS) on versions 7.2.0 (up to 7.2.0.17), 8.1.0 (up to 8.1.0.22), 8.1.1 (up to 8.1.1.7), 9.0.0 (up to 9.0.0.1) and also legacy tar installs of BoKS 7.2 without hotfix #0474 on Linux, AIX, and Solaris allows low privilege local users to dump data from the cache."}], "impacts": [{"capecId": "CAPEC-204", "descriptions": [{"lang": "en", "value": "CAPEC-204 Lifting Sensitive Data Embedded in Cache"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-524", "description": "CWE-524: Use of Cache Containing Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "shortName": "Fortra", "dateUpdated": "2025-08-29T20:11:13.423Z"}, "references": [{"url": "https://www.fortra.com/security/advisories/product-security/fi-2025-008"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upgrade to the latest patched version or hotfix"}], "value": "Upgrade to the latest patched version or hotfix"}], "source": {"discovery": "UNKNOWN"}, "title": "Core Privileged Access Manager (BoKS) Leakage of Sensitive Data via the Cache", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-17T19:50:23.706281Z", "id": "CVE-2025-5141", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-17T19:50:34.425Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5141", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-17T19:50:23.706281Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-17T19:50:26.362Z"}}], "cna": {"title": "Core Privileged Access Manager (BoKS) Leakage of Sensitive Data via the Cache", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Maciej Grabiec, ING Hubs Poland"}], "impacts": [{"capecId": "CAPEC-204", "descriptions": [{"lang": "en", "value": "CAPEC-204 Lifting Sensitive Data Embedded in Cache"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Fortra", "product": "Core Privileged Access Manager (BoKS)", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "7.2.0.17"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "8.1.0.22"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "8.1.1.7"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "9.0.0.1"}], "platforms": ["Linux", "AIX", "Solaris"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to the latest patched version or hotfix", "supportingMedia": [{"type": "text/html", "value": "Upgrade to the latest patched version or hotfix", "base64": false}]}], "references": [{"url": "https://www.fortra.com/security/advisories/product-security/fi-2025-008"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager (BoKS) on versions 7.2.0 (up to 7.2.0.17), 8.1.0 (up to 8.1.0.22), 8.1.1 (up to 8.1.1.7), 9.0.0 (up to 9.0.0.1) and also legacy tar installs of BoKS 7.2 without hotfix #0474 on Linux, AIX, and Solaris allows low privilege local users to dump data from the cache.", "supportingMedia": [{"type": "text/html", "value": "A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager (BoKS) on versions 7.2.0 (up to 7.2.0.17), 8.1.0 (up to 8.1.0.22), 8.1.1 (up to 8.1.1.7), 9.0.0 (up to 9.0.0.1) and also legacy tar installs of BoKS 7.2 without hotfix #0474 on Linux, AIX, and Solaris allows low privilege local users to dump data from the cache.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-524", "description": "CWE-524: Use of Cache Containing Sensitive Information"}]}], "providerMetadata": {"orgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "shortName": "Fortra", "dateUpdated": "2025-08-29T20:11:13.423Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5141", "state": "PUBLISHED", "dateUpdated": "2025-08-29T20:11:13.423Z", "dateReserved": "2025-05-23T21:18:11.239Z", "assignerOrgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "datePublished": "2025-06-17T19:30:51.781Z", "assignerShortName": "Fortra"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Linux", "AIX", "Solaris"], "product": "Core Privileged Access Manager (BoKS)", "vendor": "Fortra", "versions": [{"lessThanOrEqual": "7.2.0.17", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThanOrEqual": "8.1.0.22", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThanOrEqual": "8.1.1.7", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThanOrEqual": "9.0.0.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager (BoKS) on versions 7.2.0 (up to 7.2.0.17), 8.1.0 (up to 8.1.0.22), 8.1.1 (up to 8.1.1.7), 9.0.0 (up to 9.0.0.1) and also legacy tar installs of BoKS 7.2 without hotfix #0474 on Linux, AIX, and Solaris allows low privilege local users to dump data from the cache."}, {"lang": "es", "value": "Un binario en el componente BoKS Server Agent del Core Privileged Access Manager (BoKS) de Fortra en las versiones 7.2.0 (hasta 7.2.0.17), 8.1.0 (hasta 8.1.0.22), 8.1.1 (hasta 8.1.1.7), 9.0.0 (hasta 9.0.0.1) y tambi\u00e9n instalaciones tar heredadas de BoKS 7.2 sin la revisi\u00f3n n.\u00b0 0474 en Linux, AIX y Solaris permite que los usuarios locales con privilegios bajos descarguen datos de la memoria cach\u00e9."}], "id": "CVE-2025-5141", "lastModified": "2026-06-17T09:47:18.890", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5141", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-06-17T19:50:23.706281Z", "version": "2.0.3"}}]}, "published": "2025-06-17T20:15:32.583", "references": [{"source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "url": "https://www.fortra.com/security/advisories/product-security/fi-2025-008"}], "sourceIdentifier": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-524"}], "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "type": "Secondary"}]}

{}

{}