CVE-2025-62232

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-62232
Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access. It has been fixed in the following commit:  https://github.com/apache/apisix/pull/12629 Users are recommended to upgrade to version 3.14, which fixes this issue.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/32hdgh570btfhg02hfc7p7ckf9v83259 Vendor Advisory Mailing List Patch
http://www.openwall.com/lists/oss-security/2025/10/30/4 Mailing List
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*
History

05 Nov 2025, 14:44

Type Values Removed Values Added
CPE cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*
First Time Apache
Apache apisix
References () https://lists.apache.org/thread/32hdgh570btfhg02hfc7p7ckf9v83259 - () https://lists.apache.org/thread/32hdgh570btfhg02hfc7p7ckf9v83259 - Vendor Advisory, Mailing List, Patch
References () http://www.openwall.com/lists/oss-security/2025/10/30/4 - () http://www.openwall.com/lists/oss-security/2025/10/30/4 - Mailing List

31 Oct 2025, 14:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

31 Oct 2025, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-10-31 09:15

Updated : 2025-11-05 14:44

NVD link : CVE-2025-62232

Mitre link : CVE-2025-62232

CVE.ORG link : CVE-2025-62232

JSON object : View

Products Affected

apache

  • apisix
CWE
CWE-532

Insertion of Sensitive Information into Log File