CVE-2025-54467 Details
Description
When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation the password will appear in the NeuVector security event log.
A vulnerability in NeuVector versions 5.0.0 prior to 5.4.6 allows for the leakage of sensitive information, such as passwords, into the NeuVector security event log. This occurs when a Java command containing password parameters is executed and subsequently terminated due to a NeuVector Process rule violation. NeuVector's default behavior is to redact certain sensitive data from process commands in security events, but this vulnerability arises when the default redaction patterns do not cover the specific format of the sensitive information being logged.
Upgrade to NeuVector version 5.4.6 or later, where this issue has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2025CISA-ADP
Assessed Sep 17, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54467 | [email protected] | Issue TrackingVendor |
| https://github.com/neuvector/neuvector/security/advisories/GHSA-w54x-xfxg-4gxq | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NeuVector | >= 5.0.0, < 5.4.6 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2025 | New CVE Received | [email protected] |