{"metadata": {"vulnerability": "cve-2025-24355", "count": 27, "kinds": {"milestone": 6, "sighting": 4, "kev": 0, "other": 17}}, "data": [{"timestamp": "2025-01-20T15:18:26.988Z", "date_only": false, "value": "2025-01-20T15:18:26.988Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2025-24355", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-01-24T08:28:10Z", "date_only": false, "value": "2025-01-24T08:28:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/updatecli/updatecli/security/advisories/GHSA-v34r-vj4r-38j6", "record": "CVE-2025-24355", "field": "creation_timestamp", "uuid": "60411508-64b4-4f33-9551-065d413c7050", "url": "https://github.com/updatecli/updatecli/security/advisories/GHSA-v34r-vj4r-38j6"}, {"timestamp": "2025-01-24T16:48:17.723Z", "date_only": false, "value": "2025-01-24T16:48:17.723Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-24355", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-01-24T16:48:17.723Z", "date_only": false, "value": "2025-01-24T16:48:17.723Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2025-24355", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-01-24T16:53:59.576Z", "date_only": false, "value": "2025-01-24T16:53:59.576817Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/113884373877761645", "record": "CVE-2025-24355", "field": "creation_timestamp", "uuid": "26bd8a35-d073-4d2c-b5c5-4ed534aef929", "url": "https://infosec.exchange/users/cve/statuses/113884373877761645"}, {"timestamp": "2025-01-24T17:04:50Z", "date_only": false, "value": "2025-01-24T17:04:50.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/2939", "record": "CVE-2025-24355", "field": "creation_timestamp", "uuid": "7805bd1a-ef25-4f8b-8ceb-8da46cb761c8", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-24355\n\ud83d\udd39 Description: Updatecli is a tool used to apply file update strategies. Prior to version 0.93.0, private maven repository credentials may be leaked in application logs in case of unsuccessful retrieval operation. During the execution of an updatecli pipeline which contains a `maven` source configured with basic auth credentials, the credentials are being leaked in the application execution logs in case of failure. Credentials are properly sanitized when the operation is successful but not when for whatever reason there is a failure in the maven repository, e.g. wrong coordinates provided, not existing artifact or version. Version 0.93.0 contains a patch for the issue.\n\ud83d\udccf Published: 2025-01-24T16:48:17.723Z\n\ud83d\udccf Modified: 2025-01-24T16:48:17.723Z\n\ud83d\udd17 References:\n1. https://github.com/updatecli/updatecli/security/advisories/GHSA-v34r-vj4r-38j6\n2. https://github.com/updatecli/updatecli/commit/344b28091ffeca5ed32e8d0f9eda542842fcd3fa", "url": "https://t.me/DarkWebInformer_CVEAlerts/2939"}, {"timestamp": "2025-01-24T17:15:16Z", "date_only": false, "value": "2025-01-24T17:15:16Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-V34R-VJ4R-38J6", "record": "GHSA-V34R-VJ4R-38J6", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-01-24T17:15:16.047Z", "date_only": false, "value": "2025-01-24T17:15:16.047", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-24355", "record": "FKIE_CVE-2025-24355", "field": "published"}, {"timestamp": "2025-01-24T17:38:41.823Z", "date_only": false, "value": "2025-01-24T17:38:41.823434Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-24355", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-01-24T17:38:41.823Z", "date_only": false, "value": "2025-01-24T17:38:41.823434Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-24355", "record": "FKIE_CVE-2025-24355", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-01-24T18:45:20Z", "date_only": false, "value": "2025-01-24T18:45:20Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-V34R-VJ4R-38J6", "record": "GHSA-V34R-VJ4R-38J6", "field": "published"}, {"timestamp": "2025-01-24T18:45:21Z", "date_only": false, "value": "2025-01-24T18:45:21Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-V34R-VJ4R-38J6", "record": "GHSA-V34R-VJ4R-38J6", "field": "modified"}, {"timestamp": "2025-01-24T19:25:34Z", "date_only": false, "value": "2025-01-24T19:25:34.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cvedetector/16306", "record": "CVE-2025-24355", "field": "creation_timestamp", "uuid": "23228bf9-2963-49b7-913e-389d6f967d2b", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-24355 - Updatecli Unauthenticated Maven Repository Credentials Leakage\", \n  \"Content\": \"CVE ID : CVE-2025-24355 \nPublished : Jan. 24, 2025, 5:15 p.m. | 44\u00a0minutes ago \nDescription : Updatecli is a tool used to apply file update strategies. Prior to version 0.93.0, private maven repository credentials may be leaked in application logs in case of unsuccessful retrieval operation. During the execution of an updatecli pipeline which contains a `maven` source configured with basic auth credentials, the credentials are being leaked in the application execution logs in case of failure. Credentials are properly sanitized when the operation is successful but not when for whatever reason there is a failure in the maven repository, e.g. wrong coordinates provided, not existing artifact or version. Version 0.93.0 contains a patch for the issue. \nSeverity: 7.1 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"24 Jan 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/16306"}, {"timestamp": "2025-01-29T00:00:00Z", "date_only": false, "value": "2025-01-29T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:14710-1", "record": "OPENSUSE-SU-2025:14710-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-01-29T00:00:00Z", "date_only": false, "value": "2025-01-29T00:00:00Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:14710-1", "record": "OPENSUSE-SU-2025:14710-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2025-01-29T00:00:00Z", "date_only": false, "value": "2025-01-29T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:14710-1", "record": "OPENSUSE-SU-2025:14710-1", "field": "document.tracking.generator.date"}, {"timestamp": "2025-01-29T00:00:00Z", "date_only": false, "value": "2025-01-29T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:14710-1", "record": "OPENSUSE-SU-2025:14710-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2025-01-30T14:03:37Z", "date_only": false, "value": "2025-01-30T14:03:37Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2025:0297-1", "record": "SUSE-SU-2025:0297-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-01-30T14:03:37Z", "date_only": false, "value": "2025-01-30T14:03:37Z", "kind": "other", "label": "Date", "source": "csaf_suse \u00b7 SUSE-SU-2025:0297-1", "record": "SUSE-SU-2025:0297-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2025-01-30T14:03:37Z", "date_only": false, "value": "2025-01-30T14:03:37Z", "kind": "other", "label": "Document generated", "source": "csaf_suse \u00b7 SUSE-SU-2025:0297-1", "record": "SUSE-SU-2025:0297-1", "field": "document.tracking.generator.date"}, {"timestamp": "2025-01-30T14:03:37Z", "date_only": false, "value": "2025-01-30T14:03:37Z", "kind": "milestone", "label": "Published", "source": "csaf_suse \u00b7 SUSE-SU-2025:0297-1", "record": "SUSE-SU-2025:0297-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2025-01-30T14:03:37Z", "date_only": false, "value": "2025-01-30T14:03:37Z", "kind": "other", "label": "Updated", "source": "csaf_suse \u00b7 SUSE-SU-2025:0297-1", "record": "SUSE-SU-2025:0297-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2025-02-12T20:01:18.920Z", "date_only": false, "value": "2025-02-12T20:01:18.920Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2025-24355", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-02-12T20:01:18.920Z", "date_only": false, "value": "2025-02-12T20:01:18.920Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-24355", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-17T08:58:37.550Z", "date_only": false, "value": "2026-06-17T08:58:37.550", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-24355", "record": "FKIE_CVE-2025-24355", "field": "lastModified"}, {"timestamp": "2026-09-20T21:25:59Z", "date_only": false, "value": "2026-09-20T21:25:59Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:14710-1", "record": "OPENSUSE-SU-2025:14710-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-20T21:25:59Z", "date_only": false, "value": "2026-09-20T21:25:59Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:14710-1", "record": "OPENSUSE-SU-2025:14710-1", "field": "document.tracking.current_release_date"}]}