CVE-2025-37728

MediumCVSS 5.4/10Last modified Oct 8, 2026

Description

Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked. A malicious user can access cached credentials from a Crowdstrike connector in another space by creating and running a Crowdstrike connector in a space to which they have access.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
Elastic	Kibana	>= 7.0.0, <= 7.17.29; >= 8.14.0, <= 8.18.7; >= 8.19.0, <= 8.19.4; >= 9.0.0, <= 9.0.7; >= 9.1.0, <= 9.1.4

References

Timeline

Published: Oct 7, 2025
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-377297.2Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with A CVE-2025-37735.5A sensitive information exposure vulnerability in System Information Reporter (SIR) 1.0.3 and prior allows an authenticated non-admin local CVE-2025-377306.5Improper certificate validation in Logstash's TCP output could lead to a man-in-the-middle (MitM) attack in “client” mode, as hostname verif CVE-2025-377317.4Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious act CVE-2025-377325.4Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML ta CVE-2025-377344.3Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI CVE-2025-377357.0Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defen CVE-2025-377368.8Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that shou CVE-2025-377387.8In the Linux kernel, the following vulnerability has been resolved: ext4: ignore xattrs past end Once inside 'ext4_xattr_inode_dec_ref_all CVE-2025-377397.1In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks()CVE-2025-37747.2The Wise Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all versions up to, and in CVE-2025-377405.5In the Linux kernel, the following vulnerability has been resolved: jfs: add sanity check for agwidth in dbMount The width in dmapctl of t