How to fix CVE-2025-30205?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

CVE-2025-30205

HIGH

Insertion of Sensitive Information into Log File (CWE-532)

2025-03-24 [email protected]

Information Disclosure

7.6

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:33 vuln.today

CVE Published

Mar 24, 2025 - 17:15 nvd

HIGH 7.6

DescriptionNVD

kanidim-provision is a helper utility that uses kanidm's API to provision users, groups and oauth2 systems. Prior to version 1.2.0, a faulty function intrumentation in the (optional) kanidm patches provided by kandim-provision will cause the provisioned admin credentials to be leaked to the system log. This only impacts users which both use the provided patches and provision their admin or idm_admin account credentials this way. No other credentials are affected. Users should recompile kanidm with the newest patchset from tag v1.2.0 or higher. As a workaround, the user can set the log level KANIDM_LOG_LEVEL to any level higher than info, for example warn.

AnalysisAI

kanidim-provision is a helper utility that uses kanidm's API to provision users, groups and oauth2 systems. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-532. kanidim-provision is a helper utility that uses kanidm's API to provision users, groups and oauth2 systems. Prior to version 1.2.0, a faulty function intrumentation in the (optional) kanidm patches provided by kandim-provision will cause the provisioned admin credentials to be leaked to the system log. This only impacts users which both use the provided patches and provision their admin or idm_admin account credentials this way. No other credentials are affected. Users should recompile kanidm with the newest patchset from tag v1.2.0 or higher. As a workaround, the user can set the log level KANIDM_LOG_LEVEL to any level higher than info, for example warn. Version information: version 1.2.0.

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

CVE-2025-30205 vulnerability details – vuln.today

Back