CVE-2025-58445

HIGH

7.5

Description

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. All versions of Atlantis publicly expose detailed version information through its /status endpoint. This information disclosure could allow attackers to identify and target known vulnerabilities associated with the specific versions, potentially compromising the service's security posture. This issue does not currently have a fix.

Details CVE

Score CVSS v3.17.5

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie9/6/2025

Derniere modification9/10/2025

Sourcenvd

Observations honeypot0

Produits affectes

runatlantis:atlantis

Faiblesses (CWE)

CWE-200

References

https://github.com/runatlantis/atlantis/security/advisories/GHSA-xh7v-965r-23f7(security-advisories@github.com)

https://github.com/runatlantis/atlantis/security/advisories/GHSA-xh7v-965r-23f7(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.