CVE-2025-48928
MEDIUM
4,0
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: none
Availability: none
Description
AI Translation Available
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a 'core dump' in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0442
Percentile
0,9th
Updated
EPSS Score Trend (Last 90 Days)
528
Exposure of Core Dump File to an Unauthorized Control Sphere
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Potential Impacts:
Read Application Data
Read Files Or Directories
Applicable Platforms
All platforms may be affected
552
Files or Directories Accessible to External Parties
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Potential Impacts:
Read Files Or Directories
Modify Files Or Directories
Applicable Platforms
Technologies:
Cloud Computing, Not Technology-Specific
Application
Telemessage by Smarsh
CPE Identifier
View Detailed Analysis
cpe:2.3:a:smarsh:telemessage:-:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025…
https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked…