CVE-2025-66910

{"id": "CVE-2025-66910", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66910", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-19T15:55:30.827871Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 0.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-19T15:15:56.790", "references": [{"url": "https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66910_report.md", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/turms-im/turms", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/turms-im/turms/blob/develop/turms-server-common/src/main/java/im/turms/server/common/domain/admin/bo/AdminInfo.java#L34", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/turms-im/turms/blob/develop/turms-server-common/src/main/java/im/turms/server/common/domain/admin/service/BaseAdminService.java#L237", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-256"}, {"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system. The BaseAdminService class caches administrator passwords in plaintext within AdminInfo objects to optimize authentication performance. Upon successful login, raw passwords are stored unencrypted in memory in the rawPassword field. Attackers with local system access can extract these passwords through memory dumps, heap analysis, or debugger attachment, bypassing bcrypt protection."}, {"lang": "es", "value": "Turms Server v0.10.0-SNAPSHOT y anteriores contiene una vulnerabilidad de almacenamiento de contrase\u00f1as en texto plano en el sistema de autenticaci\u00f3n de administradores. La clase BaseAdminService almacena en cach\u00e9 las contrase\u00f1as de administrador en texto plano dentro de objetos AdminInfo para optimizar el rendimiento de la autenticaci\u00f3n. Tras un inicio de sesi\u00f3n exitoso, las contrase\u00f1as sin procesar se almacenan sin cifrar en memoria en el campo rawPassword. Atacantes con acceso local al sistema pueden extraer estas contrase\u00f1as a trav\u00e9s de volcados de memoria, an\u00e1lisis de mont\u00edculo o adjunci\u00f3n de depurador, eludiendo la protecci\u00f3n de bcrypt."}], "lastModified": "2026-10-13T11:10:00.203", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:turms-im:turms:0.10.0-snapshot:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9466432E-2863-4A5B-913F-E6E64090F60B"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}