EUVD-2025-208954
GHSA-2926-f789-68jv
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This represents a high-priority real-world risk despite limited EPSS or KEV data being provided. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates network-based exploitation with low complexity, no privileges required, and no user interaction needed, making this highly automatable. The availability of a public proof-of-concept exploit (github.com/hx381/cspro-exploits) significantly elevates the risk by lowering the barrier to exploitation. The high confidentiality and integrity impact combined with leaked secrets could enable attackers to pivot to database compromise, data manipulation, or complete application takeover. Organizations using CSWeb in internet-facing deployments or environments where attackers have network access should treat this as an urgent remediation priority. The fact that CISA's Cybersecurity and Infrastructure Security Agency reported this (reported by: cisa-cg) and published a CSAF advisory suggests active concern from government security agencies. |
| Exploit ScenarioDerived | A remote attacker with network access to a vulnerable CSWeb instance crafts HTTP requests targeting the app/config endpoint without any authentication. Using techniques documented in the public proof-of-concept (https://github.com/hx381/cspro-exploits), the attacker retrieves configuration files containing database credentials, API keys, session secrets, and other sensitive parameters. With these leaked credentials, the attacker gains unauthorized access to the backend database, exfiltrates sensitive census or survey data, and potentially modifies records to compromise data integrity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 23, 2026
Census CSWeb 8.0.1 contains an information disclosure vulnerability where the app/config endpoint is reachable via HTTP without authentication in certain deployments, allowing remote attackers to retrieve sensitive configuration data including secrets. This vulnerability has a CVSS score of 9.1 (Critical) and affects Census CSWeb versions prior to 8.1.0 alpha. A public proof-of-concept exploit is available on GitHub (https://github.com/hx381/cspro-exploits), significantly increasing the risk of active exploitation.
RemediationAI
Immediately upgrade Census CSWeb to version 8.1.0 alpha or later, which addresses this vulnerability as documented in the GitHub commit at https://github.com/csprousers/csweb/commit/eba0b59a243390a1a4f9524cce6dbc0314bf0d91. Until patching is complete, implement immediate compensating controls including configuring web server or reverse proxy rules to explicitly deny access to the app/config path for all external requests, restricting CSWeb access to trusted IP ranges only via firewall rules, and ensuring the application is not directly exposed to the internet. Review application configuration files for any exposed secrets and rotate all credentials, API keys, and tokens that may have been accessible through this vulnerability. Consult the CISA CSAF advisory at https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-082-01.json for additional guidance and consider implementing network segmentation to isolate CSWeb instances from untrusted networks.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Census CSWeb is a web-based data dissemination system for census and survey data. The vulnerability affects CSWeb version 8.0.1 (CPE: cpe:2.3:a:census:csweb:*:*:*:*:*:*:*:*) and stems from CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The root cause is improper access control on the app/config directory structure, which allows HTTP requests to reach configuration files that should be restricted. In certain deployment configurations, these configuration endpoints are exposed to the network without requiring authentication, enabling unauthorized access to potentially sensitive application settings, database credentials, API keys, and other secrets stored in configuration files.
Know when Csweb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Census CSWeb 8.0.1 allows "app/config" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker could send requests to configuration files and obtain leaked secrets. Fixed in 8.1.0 alpha.
Articles & Coverage 1
Executive ViewAI
Census CSWeb versions prior to 8.1.0 alpha expose sensitive configuration data and secrets through an unauthenticated HTTP endpoint, creating immediate risk of credential compromise and lateral movement across connected systems. Organizations running affected Census CSWeb deployments face potential unauthorized access to infrastructure secrets and API credentials without any authentication barrier, requiring urgent patching to prevent data exfiltration.
Apply vendor patch (Census CSWeb version 8.1.0 alpha or later). Interim mitigations if patch cannot be immediately applied: implement network-level access controls to restrict HTTP access to the /app/config endpoint to authorized internal networks only; disable or firewall the endpoint at the load balancer or WAF layer; monitor access logs for requests to /app/config and immediately rotate exposed credentials.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Census CSWeb 8.0.1 contains an arbitrary file upload vulnerability allowing authenticated remote attackers to upload mal
Census CSWeb 8.0.1 contains a path traversal vulnerability (CWE-22) allowing authenticated remote attackers to access ar
Census CSWeb 8.0.1 contains a stored cross-site scripting (XSS) vulnerability in user-supplied fields that allows authen
Exploit-DB