EUVD-2025-18186Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
All communication with the REST API is unencrypted (HTTP), allowing an attacker to intercept traffic between an actor and the webserver. This leads to the possibility of information gathering and downloading media files.
AnalysisAI
CVE-2025-49183 is an unencrypted HTTP communication vulnerability in a REST API that exposes all traffic to network-level interception, allowing unauthenticated attackers to gather sensitive information and exfiltrate media files without authentication or user interaction required. The vulnerability affects systems using unencrypted REST API endpoints and carries a CVSS 7.5 score reflecting high confidentiality impact; real-world exploitation risk depends on network positioning and whether the affected API handles sensitive data or privileged operations.
Technical ContextAI
This vulnerability stems from CWE-319 (Cleartext Transmission of Sensitive Information), a protocol-level implementation flaw where API communication defaults to HTTP instead of enforcing HTTPS/TLS encryption. The root cause is the absence of transport-layer security controls, meaning all REST API payloads—including authentication credentials, API tokens, request/response bodies, and media file contents—traverse the network in plaintext. This affects any REST API framework or service (regardless of vendor) that fails to enforce secure transport. The vulnerability is particularly severe because REST APIs commonly transmit structured JSON/XML data containing PII, credentials, and business-critical information that becomes directly readable to any network observer (ARP spoofing, DNS hijacking, ISP-level monitoring, compromised network segments, or man-in-the-middle positioning).
RemediationAI
Immediate mitigations: (1) Enforce HTTPS/TLS for all REST API endpoints by redirecting HTTP traffic to HTTPS (HTTP 301/302), configuring reverse proxies (nginx, Apache) to enforce TLS, and disabling HTTP listeners entirely; (2) Implement HSTS (HTTP Strict-Transport-Security) headers with appropriate max-age to prevent downgrade attacks; (3) Use strong TLS 1.2+ with secure cipher suites (disable RC4, MD5, DES) and valid certificates from trusted CAs; (4) Network-level mitigation: isolate API endpoints to private networks, require VPN access, or use API gateways with TLS termination. Long-term: (1) Patch to vendor-supplied version that enforces HTTPS (specific versions not available from provided data—consult vendor advisory); (2) Implement certificate pinning in clients to prevent MITM via compromised CAs; (3) Add security.txt/security policy documentation; (4) Conduct security code review to ensure no other cleartext transmission vulnerabilities exist (database connections, inter-service communication, logging).
Share
External POC / Exploit Code
Leaving vuln.today