CVE-2025-58156

{
  "id": "CVE-2025-58156",
  "sourceIdentifier": "[email protected]",
  "published": "2025-08-29T22:15:32.513",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Centurion ERP is an ERP with a focus on ITSM and automation. In versions starting from 1.12.0 to before 1.21.0, an authenticated user can view all authentication token details within the database. This includes the actual token, although only the hashed token. This does not include any un-hashed authentication token as viewable. This issue has been patched in version 1.21.0. A workaround for this is not deemed viable as it would involve disabling token authentication. Users are encouraged to remove any authentication token that was created by one of the effected versions of Centurion ERP. Webmasters can ensure this occurs by removing all authentication tokens from the database."
    },
    {
      "lang": "es",
      "value": "Centurion ERP es un ERP con un enfoque en ITSM y automatización. En versiones desde la 1.12.0 hasta la 1.21.0, un usuario autenticado puede ver todos los detalles de los tokens de autenticación dentro de la base de datos. Esto incluye el token real, aunque solo el token hasheado. Esto no incluye ningún token de autenticación sin hash como visible. Este problema ha sido parcheado en la versión 1.21.0. Una solución alternativa para esto no se considera viable ya que implicaría deshabilitar la autenticación por token. Se anima a los usuarios a eliminar cualquier token de autenticación que haya sido creado por una de las versiones afectadas de Centurion ERP. Los webmasters pueden asegurar que esto ocurra eliminando todos los tokens de autenticación de la base de datos."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "nofusscomputing",
          "product": "centurion_erp",
          "versions": [
            {
              "version": ">= 1.12.0, < 1.21.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
          "baseScore": 1.9,
          "baseSeverity": "LOW",
          "attackVector": "PHYSICAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 0.5,
        "impactScore": 1.4
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-02T19:22:11.950327Z",
          "id": "CVE-2025-58156",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nofusscomputing:centurion_erp:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.12.0",
              "versionEndExcluding": "1.21.0",
              "matchCriteriaId": "19D7D2C6-7868-40B8-9FC4-E53824C3B942"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/nofusscomputing/centurion_erp/commit/332eb1075ad828e5c4c24caeaf5605259eb7ce34",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/nofusscomputing/centurion_erp/pull/974",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking"
      ]
    },
    {
      "url": "https://github.com/nofusscomputing/centurion_erp/security/advisories/GHSA-x75j-cm35-5qcg",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}