CVE-2025-4526CWE-200CWE-549information-disclosure

CVE-2025-4526

Medium · published May 11, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
21.2
In the wild
Unconfirmed
What it is

A vulnerability was identified in Dígitro NGC Explorer up to 3.48.21. The affected element is an unknown function of the component Configuration Page. Such manipulation leads to missing password field masking. It is possible to launch the attack remotely. Upgrading to version 3.48.22 is sufficient to fix this issue. It is suggested to upgrade the affected component. The action taken by the vendor is: "Review and correction of controls related to the exposure of user information in the product configuration interface." The vulnerabilities are limited to NGC Explorer and do not affect other Dígitro products, including UNA and Guardião.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00297 · 21.2th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-549 · Missing Password Field Masking
Published
2025-05-11T05:15Z
Affected products (1)
ProductVersionsFixed in
digitro/ngc_explorerall versions—
References (7)
https://digitro.com/esclarecimentos-recomendacoes-ctir-gov/ · [email protected]https://digitro.com/recomendacao-10-2026-ctir-gov/ · [email protected]https://vuldb.com/cve/CVE-2025-4526 · [email protected]https://vuldb.com/submit/565307 · [email protected]https://vuldb.com/vuln/308271 · [email protected]https://vuldb.com/vuln/308271/cti · [email protected]https://www.gov.br/ctir/pt-br/assuntos/alertas-e-recomendacoes/recomendacoes/2026/recomendacao-10-2026 · [email protected]
EPSS history
Timeline
  • 11 MAY 01:00Z
    Dígitro NGC Explorer Configuration missing password field masking
    cvelistv5