Skip to content
Log inStart free trial

CVE-2025-48927

The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in…

Medium Known exploited
Severity
5.3 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
11.57%
Chance of exploitation in the next 30 days. Higher than 96.03% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog since Jul 1, 2025
Weakness
CWE-1188 Initialization of a Resource with an Insecure Default
Fix
None yet
No fixed version published
Exploited in the wild. TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability (TeleMessage TM SGNL). Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by Jul 22, 2025.

Description

The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 3.1 5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Weakness

CWE-1188: Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

References

Other links

Timeline

  1. Published
  2. Added to CISA's Known Exploited Vulnerabilities catalog
  3. Remediation due for U.S. federal agencies
  4. Last updated by the source
  5. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-9qh4-3jw8-366w
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
Critical Same weakness, CWE-1188
GHSA-jxxv-8r27-vm4p
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
Critical Same weakness, CWE-1188
GHSA-p3m8-78j2-g5p3
NLTK: Default ENFORCE=False Disables All pathsec Security Controls
High Same weakness, CWE-1188
GHSA-xr9x-r78c-5hrm
Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing
Critical Same weakness, CWE-1188
GHSA-jr9p-4h4j-6c58
Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
Critical Same weakness, CWE-1188
GHSA-fj8f-m44g-c479
PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats
High Same weakness, CWE-1188
GHSA-9h47-pqcx-hjr4
Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default
Critical Same weakness, CWE-1188
GHSA-5xfx-xj4h-5p7r
SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()
Critical Same weakness, CWE-1188
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor