CVE-2025-58156

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-58156", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-08-27T13:34:56.185Z", "datePublished": "2025-08-29T21:40:16.813Z", "dateUpdated": "2025-09-02T19:22:22.110Z"}, "containers": {"cna": {"title": "Centurion ERP users can view hashed authentication tokens that belong to other users", "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "lang": "en", "description": "CWE-285: Improper Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/nofusscomputing/centurion_erp/security/advisories/GHSA-x75j-cm35-5qcg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nofusscomputing/centurion_erp/security/advisories/GHSA-x75j-cm35-5qcg"}, {"name": "https://github.com/nofusscomputing/centurion_erp/pull/974", "tags": ["x_refsource_MISC"], "url": "https://github.com/nofusscomputing/centurion_erp/pull/974"}, {"name": "https://github.com/nofusscomputing/centurion_erp/commit/332eb1075ad828e5c4c24caeaf5605259eb7ce34", "tags": ["x_refsource_MISC"], "url": "https://github.com/nofusscomputing/centurion_erp/commit/332eb1075ad828e5c4c24caeaf5605259eb7ce34"}], "affected": [{"vendor": "nofusscomputing", "product": "centurion_erp", "versions": [{"version": ">= 1.12.0, < 1.21.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-08-29T21:40:16.813Z"}, "descriptions": [{"lang": "en", "value": "Centurion ERP is an ERP with a focus on ITSM and automation. In versions starting from 1.12.0 to before 1.21.0, an authenticated user can view all authentication token details within the database. This includes the actual token, although only the hashed token. This does not include any un-hashed authentication token as viewable. This issue has been patched in version 1.21.0. A workaround for this is not deemed viable as it would involve disabling token authentication. Users are encouraged to remove any authentication token that was created by one of the effected versions of Centurion ERP. Webmasters can ensure this occurs by removing all authentication tokens from the database."}], "source": {"advisory": "GHSA-x75j-cm35-5qcg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-02T19:22:11.950327Z", "id": "CVE-2025-58156", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-02T19:22:22.110Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-58156", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-02T19:22:11.950327Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-02T19:22:17.598Z"}}], "cna": {"title": "Centurion ERP users can view hashed authentication tokens that belong to other users", "source": {"advisory": "GHSA-x75j-cm35-5qcg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 1.9, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "nofusscomputing", "product": "centurion_erp", "versions": [{"status": "affected", "version": ">= 1.12.0, < 1.21.0"}]}], "references": [{"url": "https://github.com/nofusscomputing/centurion_erp/security/advisories/GHSA-x75j-cm35-5qcg", "name": "https://github.com/nofusscomputing/centurion_erp/security/advisories/GHSA-x75j-cm35-5qcg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nofusscomputing/centurion_erp/pull/974", "name": "https://github.com/nofusscomputing/centurion_erp/pull/974", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nofusscomputing/centurion_erp/commit/332eb1075ad828e5c4c24caeaf5605259eb7ce34", "name": "https://github.com/nofusscomputing/centurion_erp/commit/332eb1075ad828e5c4c24caeaf5605259eb7ce34", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Centurion ERP is an ERP with a focus on ITSM and automation. In versions starting from 1.12.0 to before 1.21.0, an authenticated user can view all authentication token details within the database. This includes the actual token, although only the hashed token. This does not include any un-hashed authentication token as viewable. This issue has been patched in version 1.21.0. A workaround for this is not deemed viable as it would involve disabling token authentication. Users are encouraged to remove any authentication token that was created by one of the effected versions of Centurion ERP. Webmasters can ensure this occurs by removing all authentication tokens from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285: Improper Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-08-29T21:40:16.813Z"}}}, "cveMetadata": {"cveId": "CVE-2025-58156", "state": "PUBLISHED", "dateUpdated": "2025-09-02T19:22:22.110Z", "dateReserved": "2025-08-27T13:34:56.185Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-08-29T21:40:16.813Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "centurion_erp", "vendor": "nofusscomputing", "versions": [{"status": "affected", "version": ">= 1.12.0, < 1.21.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nofusscomputing:centurion_erp:*:*:*:*:*:*:*:*", "matchCriteriaId": "19D7D2C6-7868-40B8-9FC4-E53824C3B942", "versionEndExcluding": "1.21.0", "versionStartIncluding": "1.12.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Centurion ERP is an ERP with a focus on ITSM and automation. In versions starting from 1.12.0 to before 1.21.0, an authenticated user can view all authentication token details within the database. This includes the actual token, although only the hashed token. This does not include any un-hashed authentication token as viewable. This issue has been patched in version 1.21.0. A workaround for this is not deemed viable as it would involve disabling token authentication. Users are encouraged to remove any authentication token that was created by one of the effected versions of Centurion ERP. Webmasters can ensure this occurs by removing all authentication tokens from the database."}, {"lang": "es", "value": "Centurion ERP es un ERP con un enfoque en ITSM y automatizaci\u00f3n. En versiones desde la 1.12.0 hasta la 1.21.0, un usuario autenticado puede ver todos los detalles de los tokens de autenticaci\u00f3n dentro de la base de datos. Esto incluye el token real, aunque solo el token hasheado. Esto no incluye ning\u00fan token de autenticaci\u00f3n sin hash como visible. Este problema ha sido parcheado en la versi\u00f3n 1.21.0. Una soluci\u00f3n alternativa para esto no se considera viable ya que implicar\u00eda deshabilitar la autenticaci\u00f3n por token. Se anima a los usuarios a eliminar cualquier token de autenticaci\u00f3n que haya sido creado por una de las versiones afectadas de Centurion ERP. Los webmasters pueden asegurar que esto ocurra eliminando todos los tokens de autenticaci\u00f3n de la base de datos."}], "id": "CVE-2025-58156", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.5, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58156", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-02T19:22:11.950327Z", "version": "2.0.3"}}]}, "published": "2025-08-29T22:15:32.513", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nofusscomputing/centurion_erp/commit/332eb1075ad828e5c4c24caeaf5605259eb7ce34"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/nofusscomputing/centurion_erp/pull/974"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/nofusscomputing/centurion_erp/security/advisories/GHSA-x75j-cm35-5qcg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-08-31T08:41:35.038375+00:00", "updated": "2025-08-31T08:41:35.038441+00:00", "vendors": ["nofusscomputing", "nofusscomputing$PRODUCT$centurion_erp"]}