CVE-2025-46808: CWE-532: Insertion of Sensitive Information into Log File in SUSE neuvector
Affects SUSE neuvectorSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| SUSEneuvector | Affected
| Fixed in
|
GitHub Actionsneuvector/managerpkg:github/neuvector/managerOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available in SUSE neuvector version 5.4.5 and later. Users should upgrade to version 5.4.5 or newer to remediate this vulnerability. No additional mitigation steps are specified.
Description
CVE-2025-46808 is a vulnerability in SUSE neuvector manager versions before 5.4.5 that allows sensitive information to be inserted into the manager container's log files. This exposure could lead to unauthorized disclosure of sensitive data. The vulnerability has a medium severity with a CVSS score of 6.8. It requires low privileges and user interaction to exploit and impacts confidentiality without affecting integrity or availability.
Impact
The vulnerability exposes sensitive information in log files, which could be accessed by unauthorized users with access to the manager container logs. This compromises confidentiality but does not affect integrity or availability of the system. There are no known exploits in the wild at this time.
Summary
This vulnerability (CVE-2025-46808) involves the insertion of sensitive information into log files within the SUSE neuvector manager container. Versions of neuvector prior to 5.4.5 are affected. The flaw allows sensitive data to be exposed in logs, potentially leading to confidentiality breaches. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction needed, and a scope change with high confidentiality impact but no integrity or availability impact.