CVE-2025-12365 - OpenCVE

Error Messages Wrapped In HTTP Header.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Azure Access Technology	Blu-ic2 Blu-ic4

No data.

No data.

References

Link	Providers
https://azure-access.com/security-advisories

History

Tue, 28 Oct 2025 10:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Azure Access Technology Azure Access Technology blu-ic2 Azure Access Technology blu-ic4
Vendors & Products		Azure Access Technology Azure Access Technology blu-ic2 Azure Access Technology blu-ic4

Mon, 27 Oct 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 27 Oct 2025 18:30:00 +0000

Type	Values Removed	Values Added
Description		Error Messages Wrapped In HTTP Header.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Title		Error Messages Wrapped In HTTP Header
Weaknesses		CWE-209
References		https://azure-access.com/security-advisories
Metrics		cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L'}`

MITRE

Status: PUBLISHED

Assigner: azure-access

Published: 2025-10-27T18:12:35.604Z

Updated: 2025-10-27T18:37:18.986Z

Reserved: 2025-10-27T18:11:04.100Z

Link: CVE-2025-12365

Vulnrichment

Updated: 2025-10-27T18:37:14.873Z

NVD

Status : Awaiting Analysis

Published: 2025-10-27T19:16:02.793

Modified: 2025-10-30T15:05:50.613

Link: CVE-2025-12365

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-12365", "assignerOrgId": "a0340c66-c385-4f8b-991b-3d05f6fd5220", "state": "PUBLISHED", "assignerShortName": "azure-access", "dateReserved": "2025-10-27T18:11:04.100Z", "datePublished": "2025-10-27T18:12:35.604Z", "dateUpdated": "2025-10-27T18:37:18.986Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "BLU-IC2", "vendor": "Azure Access Technology", "versions": [{"lessThanOrEqual": "1.19.5", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "BLU-IC4", "vendor": "Azure Access Technology", "versions": [{"lessThanOrEqual": "1.19.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Kevin Schaller"}, {"lang": "en", "type": "finder", "value": "Benjamin Lafois"}, {"lang": "en", "type": "finder", "value": "Alexi Bitsios"}, {"lang": "en", "type": "finder", "value": "Sebastian Toscano"}, {"lang": "en", "type": "finder", "value": "Dominik Schneider"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Error Messages Wrapped In HTTP Header.<p>This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.</p>"}], "value": "Error Messages Wrapped In HTTP Header.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5."}], "impacts": [{"capecId": "CAPEC-116", "descriptions": [{"lang": "en", "value": "CAPEC-116 Excavation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-209", "description": "CWE-209 Generation of Error Message Containing Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a0340c66-c385-4f8b-991b-3d05f6fd5220", "shortName": "azure-access", "dateUpdated": "2025-10-27T18:12:35.604Z"}, "references": [{"url": "https://azure-access.com/security-advisories"}], "source": {"discovery": "UNKNOWN"}, "title": "Error Messages Wrapped In HTTP Header", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-27T18:34:41.878171Z", "id": "CVE-2025-12365", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T18:37:18.986Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-12365", "assignerOrgId": "a0340c66-c385-4f8b-991b-3d05f6fd5220", "state": "PUBLISHED", "assignerShortName": "azure-access", "dateReserved": "2025-10-27T18:11:04.100Z", "datePublished": "2025-10-27T18:12:35.604Z", "dateUpdated": "2025-10-27T18:37:18.986Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "BLU-IC2", "vendor": "Azure Access Technology", "versions": [{"lessThanOrEqual": "1.19.5", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "BLU-IC4", "vendor": "Azure Access Technology", "versions": [{"lessThanOrEqual": "1.19.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Kevin Schaller"}, {"lang": "en", "type": "finder", "value": "Benjamin Lafois"}, {"lang": "en", "type": "finder", "value": "Alexi Bitsios"}, {"lang": "en", "type": "finder", "value": "Sebastian Toscano"}, {"lang": "en", "type": "finder", "value": "Dominik Schneider"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Error Messages Wrapped In HTTP Header.<p>This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.</p>"}], "value": "Error Messages Wrapped In HTTP Header.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5."}], "impacts": [{"capecId": "CAPEC-116", "descriptions": [{"lang": "en", "value": "CAPEC-116 Excavation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-209", "description": "CWE-209 Generation of Error Message Containing Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a0340c66-c385-4f8b-991b-3d05f6fd5220", "shortName": "azure-access", "dateUpdated": "2025-10-27T18:12:35.604Z"}, "references": [{"url": "https://azure-access.com/security-advisories"}], "source": {"discovery": "UNKNOWN"}, "title": "Error Messages Wrapped In HTTP Header", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12365", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-27T18:34:41.878171Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T18:37:14.873Z"}}]}}