CVE-2025-52493

{
  "id": "CVE-2025-52493",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-10T17:15:53.693",
  "lastModified": "2026-11-04T22:10:00.210",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PagerDuty Runbook through 2025-06-12 exposes stored secrets directly in the webpage DOM at the configuration page. Although these secrets appear masked as password fields, the actual secret values are present in the page source and can be revealed by simply modifying the input field type from \"password\" to \"text\" using browser developer tools. This vulnerability is exploitable by administrative users who have access to the configuration page."
    },
    {
      "lang": "es",
      "value": "PagerDuty Runbook hasta 2025-06-12 expone secretos almacenados directamente en el DOM de la página web en la página de configuración. Aunque estos secretos aparecen enmascarados como campos de contraseña, los valores reales de los secretos están presentes en el código fuente de la página y pueden revelarse simplemente modificando el tipo del campo de entrada de “password” a “text” usando las herramientas de desarrollo del navegador. Esta vulnerabilidad es explotable por usuarios administrativos que tienen acceso a la página de configuración."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-11T16:06:28.083070Z",
          "id": "CVE-2025-52493",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:pagerduty:runbook_automation:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "2025-06-12",
              "matchCriteriaId": "9AE4D0D6-E780-4B51-BF95-63CD6E1D3542"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/carterross2/Vulnerability-Research/tree/main/CVE-2025-52493",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.pagerduty.com/platform/automation/",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://www.pagerduty.com/security/disclosure/",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://www.praetorian.com",
      "source": "[email protected]",
      "tags": [
        "Not Applicable"
      ]
    }
  ]
}