Skip to content
Fencer Vulns
high 7.1

CVE-2025-24355 json

Updatecli may expose Maven credentials in console output

published 2025-01-24 21 mo ago modified 2026-06-17 4 mo ago also GHSA-v34r-vj4r-38j6 , GO-2025-3419 , EUVD-2025-0193

cvss
7.1
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits
0
none known

Summary

Updatecli is a tool used to apply file update strategies. Prior to version 0.93.0, private maven repository credentials may be leaked in application logs in case of unsuccessful retrieval operation. During the execution of an updatecli pipeline which contains a `maven` source configured with basic auth credentials, the credentials are being leaked in the application execution logs in case of failure. Credentials are properly sanitized when the operation is successful but not when for whatever reason there is a failure in the maven repository, e.g. wrong coordinates provided, not existing artifact or version. Version 0.93.0 contains a patch for the issue.

Patch / fix

  • go github.com/updatecli/updatecli 0.93.0
  • govulncheck-vulndb SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 0.0.20250128T150132-150000.1.29.1

suse advisories SUSE-SU-2025:0297-1

  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20250128T150132-1.1

opensuse advisories openSUSE-SU-2025:14710-1

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
21 mo ago

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 7.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
GitHub 3.0 7.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/updatecli/updatecli
<0.93.0
0.93.0

Affected products

  • updatecli updatecli

Classification

Weakness
  • CWE-359 Exposure of Private Personal Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.