CVE-2025-8530: elunez eladmin Druid application-prod.yml default credentials
A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is some unknown functionality of the file eladmin-system\src\main\resources\config\application-prod.yml of the component Druid. The manipulation of the argument login-username/login-password leads to use of default credentials. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
elunez eladminto a version that resolves this vulnerability.Fixed in 2.7 - Compensating control
Because the attack may be launched remotely, restrict access to the elunez eladmin Druid application endpoints (e.g., via network firewall/ACL) until the default-credential issue is remediated.
- Operational
Change the default credentials created/used via eladmin-system\src\main\resources\config\application-prod.yml (manipulation of login-username/login-password leads to use of default credentials).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8530?
CVE-2025-8530 has been classified as problematic.
How do I fix CVE-2025-8530?
To fix CVE-2025-8530, upgrade elunez eladmin to a version higher than 2.7.
What components are affected by CVE-2025-8530?
CVE-2025-8530 affects the eladmin component of the Druid functionality.
Can CVE-2025-8530 be exploited remotely?
The specific details on remote exploitation for CVE-2025-8530 have not been disclosed.
Is CVE-2025-8530 easy to exploit?
The exploitability of CVE-2025-8530 is categorized as problematic, indicating potential ease of exploitation.