CVE-2025-58445: falha de média gravidade em runatlantis atlantis
Atlantis Exposes Service Version Publicly on /status API Endpoint
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.5%
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. All versions of Atlantis publicly expose detailed version information through its /status endpoint. This information disclosure could allow attackers to identify and target known vulnerabilities associated with the specific versions, potentially compromising the service's security posture. This issue does not currently have a fix.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
runatlantis · atlantisCVEs relacionadas — runatlantis atlantis
No mesmo produto, das mais perigosas para as menos.
CVE-2026-64679HIGHAtlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/CreationEPSS 0.8%CVE-2024-52009HIGHGit credentials are exposed in atlantis logsEPSS 0.7%CVE-2026-116676HIGHAtlantis: OS command injection through PR-controlled Terraform workspace enables RCE during planEPSS 0.5%CVE-2026-82282HIGHAtlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated CallersEPSS 0.4%