CVE-2025-25013

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens via automatic transmission of unfiltered environment variables to the stack.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

VendorProductVersions
ElasticElastic Defend>= 8.0.0, < 8.17.3

References

Timeline

Published
Apr 8, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-250149.8A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting CVE-2025-250159.9Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana CVE-2025-250164.3Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file dCVE-2025-250176.1Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)CVE-2025-250185.4Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)CVE-2025-250196.5IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not invalidate session aCVE-2025-25027.8An improper default permissions vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges.CVE-2025-250206.5IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an authenticated CVE-2025-250217.2IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow a privileged execCVE-2025-250228.8IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an unauthenticateCVE-2025-250234.9IBM Security Guardium 11.4 and 12.1 could allow a privileged user to read any file on the system due to incorrect privilege assignment.CVE-2025-250255.3IBM Security Guardium 12.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned
CVE-2025-25013: Medium severity, CVSS 6.5 | Vulnix