CVE-2025-25002

MediumCVSS 5.7/10Last modified Jun 17, 2026

Description

Insertion of sensitive information into log file in Azure Local Cluster allows an authorized attacker to disclose information over an adjacent network.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

Vendor	Product	Versions
Microsoft	Azure Local Cluster	>= 1.0.0, < 2411.2

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25002Vendor Advisory

Timeline

Published: Apr 8, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-250037.3Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.CVE-2025-250047.3Improper access control in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.CVE-2025-250056.5Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.CVE-2025-250065.3Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a netw CVE-2025-250075.3Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over CVE-2025-250087.1Improper link resolution before file access ('link following') in Microsoft Windows allows an authorized attacker to elevate privileges loca CVE-2025-250095.4Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.CVE-2025-25017.8An untrusted search path vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges.CVE-2025-250106.5Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to CVE-2025-250117.0An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulne CVE-2025-250125.4URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request for CVE-2025-250136.5Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens vi