CVE-2025-5731: Infinispan: credential leakage in infinispan cli
A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.
Other sources
A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5731?
CVE-2025-5731 is classified as a medium severity vulnerability due to its potential to expose sensitive password information.
How do I fix CVE-2025-5731?
To fix CVE-2025-5731, ensure that the sensitive passwords are not processed in plaintext and use secure methods for handling command strings.
What versions of Infinispan CLI are affected by CVE-2025-5731?
CVE-2025-5731 affects versions of Infinispan CLI up to and including 16.0.0.Dev01.
What type of information is exposed by CVE-2025-5731?
CVE-2025-5731 can expose sensitive password data if a command is not found and results in an error message.
Is there a public advisory for CVE-2025-5731?
Yes, there are public advisories available detailing CVE-2025-5731 and its implications.