CVE-2025-48374 - CVE House
Back to Database
Status published Medium CVE-2025-48374

zot logs secrets

Vulnerability Description

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f), when using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout logs for an example at container startup. Version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f) fixes the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-48374

Credits & Attribution

No credits recorded in the NVD database.

References

More from project-zot

View All →
CVE-2025-23208
IdP group membership revocation ignored in zot
High 7.3
CVE-2024-39897
Cache driver GetBlob() allows read access to any blob without access control check
Medium 4.3

Affected Vendor

project-zot

View all reports →

Affected Software

zot
Vulnerable Versions:
< 1.4.4-0.20250522160828-8a99a3ed231f

Timeline

Official Publish: May 22nd, 2025
Last Modified: May 23rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-532

MITRE ATT&CK TTPs

T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1555 Credentials from Password Stores
Credential Access
T1078 Valid Accounts
Persistence
T1562 Impair Defenses
Defense Evasion