CVE-2025-48928
28.05.2025, 17:15
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.Enginsight
| Vendor | Product | Version |
|---|---|---|
| smarsh | telemessage | - |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-528 - Exposure of Core Dump File to an Unauthorized Control SphereThe product generates a core dump file in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.
- CWE-552 - Files or Directories Accessible to External PartiesThe product makes files or directories accessible to unauthorized actors, even though they should not be.
Vulnerability Media Exposure