CVE-2025-40680CWE-311

Encryption of sensitive data in CapillaryScope missing

Medium · published July 24, 2025

CVSS v4.0
6.9
EPSS
0%
Percentile
0.1
In the wild
Unconfirmed
What it is

Lack of sensitive data encryption in CapillaryScope v2.5.0 of Capillary io, which stores both the proxy credentials and the JWT session token in plain text within different registry keys on the Windows operating system. Any authenticated local user with read access to the registry can extract these sensitive values.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00079 · 0.1th percentile
Weakness
CWE-311 · Missing Encryption of Sensitive Data
Published
2025-07-24T12:14Z
EPSS history
Timeline
  • 24 JUL 12:14Z
    Encryption of sensitive data in CapillaryScope missing
    cvelistv5