{"id":"CVE-2025-1075","aliases":["EUVD-2025-4707","GHSA-rg5f-r5jw-rvxg","UBUNTU-CVE-2025-1075"],"status":"published","title":"LDAP credentials logged to Apache error log","description":"Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions \u003c2.3.0p27, \u003c2.2.0p40, and 2.1.0p51 (EOL) causes LDAP credentials to be written to Apache error log file accessible to administrators.","severity":{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00317,"percentile":0.24863,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-532"],"published":"2025-02-19T09:49:55Z","modified":"2026-10-28T02:30:56Z","affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"check-mk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.6p5-1","1.2.6p12-1","1.2.6p12-1ubuntu0.16.04.1","1.2.6p12-1ubuntu0.16.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"check-mk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.8p16-1ubuntu0.1","1.2.8p16-1ubuntu0.2"]}],"products":[{"vendor":"checkmk","product":"checkmk"},{"vendor":"checkmk gmbh","product":"checkmk"}],"references":[{"url":"https://checkmk.com/werk/17495","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1075","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rg5f-r5jw-rvxg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/1xxx/CVE-2025-1075.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-1075","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-1075","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-1075","title":"LDAP credentials logged to Apache error log","description":"Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions \u003c2.3.0p27, \u003c2.2.0p40, and 2.1.0p51 (EOL) causes LDAP credentials to be written to Apache error log file accessible to administrators.","status":"published","published":"2025-02-19T09:49:55.695Z","modified":"2025-11-13T12:54:20.274Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:32:49.503917Z"}],"euvd":[{"id":"EUVD-2025-4707","description":"Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions \u003c2.3.0p27, \u003c2.2.0p40, and 2.1.0p51 (EOL) causes LDAP credentials to be written to Apache error log file accessible to administrators.","status":"published","published":"2025-02-19T09:49:55Z","modified":"2025-11-13T12:54:20Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:49:17.986196Z"}],"ghsa":[{"id":"GHSA-rg5f-r5jw-rvxg","title":"Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions \u003c2.3.0p27, \u003c2...","description":"Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions \u003c2.3.0p27, \u003c2.2.0p40, and 2.1.0p51 (EOL) causes LDAP credentials to be written to Apache error log file accessible to administrators.","status":"published","published":"2025-02-19T12:31:44Z","modified":"2025-08-25T03:34:11Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:03:23.773614Z"}],"nvd":[{"id":"CVE-2025-1075","description":"Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions \u003c2.3.0p27, \u003c2.2.0p40, and 2.1.0p51 (EOL) causes LDAP credentials to be written to Apache error log file accessible to administrators.","status":"published","published":"2025-02-19T10:15:09.043Z","modified":"2026-06-17T08:38:20.44Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:10:51.445921Z"}],"osv":[{"id":"CVE-2025-1075","title":"LDAP credentials logged to Apache error log","description":"Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions \u003c2.3.0p27, \u003c2.2.0p40, and 2.1.0p51 (EOL) causes LDAP credentials to be written to Apache error log file accessible to administrators.","status":"published","published":"2025-02-19T09:49:55.695Z","modified":"2026-10-28T02:30:56.372100968Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:44:45.712478Z"},{"id":"UBUNTU-CVE-2025-1075","description":"Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions \u003c2.3.0p27, \u003c2.2.0p40, and 2.1.0p51 (EOL) causes LDAP credentials to be written to Apache error log file accessible to administrators.","status":"published","published":"2025-02-19T10:15:00Z","modified":"2025-10-24T05:16:28Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:20.144818Z"}]}}