CVE-2025-24984
Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.
Medium
Known exploited
- Severity
- 4.6 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 1.99%
- Chance of exploitation in the next 30 days. Higher than 80.70% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Mar 11, 2025
- Weakness
- CWE-532 Insertion of Sensitive Information into Log File
- Fix
- None yet
- No fixed version published
Exploited in the wild. Microsoft Windows NTFS Information Disclosure Vulnerability (Microsoft Windows). Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by Apr 1, 2025.
Description
Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 4.6
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Physical
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-532: Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.
How to prevent it
- Architecture and Design, Implementation: Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
- Distribution: Remove debug log files before deploying the application into production.
- Operation: Protect log files against unauthorized read/write.
- Implementation: Adjust configurations appropriately when software is transitioned from a debug state to production.
References
Advisories
Other links
Timeline
- Added to CISA's Known Exploited Vulnerabilities catalog
- Published
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-j7qq-vr8c-xvw3 MLflow CrewAI autologging records LLM provider API keys in logged trace spans | Medium | Same weakness, CWE-532 |
| EEF-CVE-2026-105963 Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments | Not rated yet | Same weakness, CWE-532 |
| GHSA-4xvq-3m68-h444 Backstage has sensitive information exposure in scaffolder task logs | Medium | Same weakness, CWE-532 |
| GHSA-95p4-vv4g-jxxm Backstage may expose sensitive information in Scaffolder task failure events | Medium | Same weakness, CWE-532 |
| GHSA-mfvq-x7vr-rgqg Backstage: Secret-derived values may be exposed in scaffolder task logs | Medium | Same weakness, CWE-532 |
| GHSA-444v-8vxr-p36h OpenBao Agent Writes Secrets to Stdout | Low | Same weakness, CWE-532 |
| EEF-CVE-2026-82723 Actor record with password digest stored in AshAuthentication audit log entries | Not rated yet | Same weakness, CWE-532 |
| GHSA-8wmf-6v46-5gfg OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs | Low | Same weakness, CWE-532 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor