What is the CVSS score of CVE-2025-24355?

CVE-2025-24355 has a CVSS 3.0 base score of 7.1 (High). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Suse are affected by CVE-2025-24355?

Organizations using Updatecli face moderate risk from CVE-2025-24355 rated CVSS 7.1. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-24355?

Within 30 days: Identify all affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Suse CVE-2025-24355

HIGH

Exposure of Private Personal Information to an Unauthorized Actor (CWE-359)

2025-01-24 security-advisories@github.com

Information Disclosure Suse

7.1

CVSS 3.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 28, 2026 - 18:05 vuln.today

CVE Published

Jan 24, 2025 - 17:15 nvd

HIGH 7.1

DescriptionGitHub Advisory

Updatecli is a tool used to apply file update strategies. Prior to version 0.93.0, private maven repository credentials may be leaked in application logs in case of unsuccessful retrieval operation. During the execution of an updatecli pipeline which contains a maven source configured with basic auth credentials, the credentials are being leaked in the application execution logs in case of failure. Credentials are properly sanitized when the operation is successful but not when for whatever reason there is a failure in the maven repository, e.g. wrong coordinates provided, not existing artifact or version. Version 0.93.0 contains a patch for the issue.

AnalysisAI

Updatecli is a tool used to apply file update strategies. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-359. Updatecli is a tool used to apply file update strategies. Prior to version 0.93.0, private maven repository credentials may be leaked in application logs in case of unsuccessful retrieval operation. During the execution of an updatecli pipeline which contains a maven source configured with basic auth credentials, the credentials are being leaked in the application execution logs in case of failure. Credentials are properly sanitized when the operation is successful but not when for whatever reason there is a failure in the maven repository, e.g. wrong coordinates provided, not existing artifact or version. Version 0.93.0 contains a patch for the issue. Version information: version 0.93.0.

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Same weakness CWE-359 – Exposure of Private Personal Information to an Unauthorized Actor

View all

CVE-2024-11396 MEDIUM POC

5.3

CVE-2022-0482 CRITICAL POC

9.1

CVE-2025-54125 HIGH POC

8.7

CVE-2022-2921 HIGH POC

8.8

CVE-2019-25762 HIGH POC

8.7

CVE-2024-10267 HIGH POC

7.5

CVE-2020-37173 HIGH POC

7.5

CVE-2025-65857 HIGH POC

7.5

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

Vendor StatusVendor

SUSE

Severity: High

Product	Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest	Affected
SUSE Linux Enterprise Server 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Server 16.1	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed

CVE-2025-24355 vulnerability details – vuln.today

Back

openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
openSUSE Leap 15.5	Fixed

Suse CVE-2025-24355

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Same weakness CWE-359 – Exposure of Private Personal Information to an Unauthorized Actor

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code