CVE-2025-54882

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-54882
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stores the cloud TGT received during logon in the Kerberos credential cache. The created credential cache collection and received credentials are stored as world readable. This is fixed in versions 0.9.22 and 1.2.0. To work around this issue, remove all read access to Himmelblau caches for all users except for owners.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/himmelblau-idm/himmelblau/commit/b562053df3dffb1dd9ab3d09af986886773be2ad Patch
https://github.com/himmelblau-idm/himmelblau/commit/faae58b0384aca8b21b4be5f1c507412eec3778a Patch
https://github.com/himmelblau-idm/himmelblau/releases/tag/0.9.22 Release Notes
https://github.com/himmelblau-idm/himmelblau/releases/tag/1.2.0 Release Notes
https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-phfx-rjfw-wj83 Exploit Vendor Advisory
https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-phfx-rjfw-wj83 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:himmelblau-idm:himmelblau:*:*:*:*:*:*:*:*
cpe:2.3:a:himmelblau-idm:himmelblau:*:*:*:*:*:*:*:*
History

09 Oct 2025, 17:36

Type Values Removed Values Added
CPE cpe:2.3:a:himmelblau-idm:himmelblau:*:*:*:*:*:*:*:*
First Time Himmelblau-idm
Himmelblau-idm himmelblau
References () https://github.com/himmelblau-idm/himmelblau/commit/b562053df3dffb1dd9ab3d09af986886773be2ad - () https://github.com/himmelblau-idm/himmelblau/commit/b562053df3dffb1dd9ab3d09af986886773be2ad - Patch
References () https://github.com/himmelblau-idm/himmelblau/commit/faae58b0384aca8b21b4be5f1c507412eec3778a - () https://github.com/himmelblau-idm/himmelblau/commit/faae58b0384aca8b21b4be5f1c507412eec3778a - Patch
References () https://github.com/himmelblau-idm/himmelblau/releases/tag/0.9.22 - () https://github.com/himmelblau-idm/himmelblau/releases/tag/0.9.22 - Release Notes
References () https://github.com/himmelblau-idm/himmelblau/releases/tag/1.2.0 - () https://github.com/himmelblau-idm/himmelblau/releases/tag/1.2.0 - Release Notes
References () https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-phfx-rjfw-wj83 - () https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-phfx-rjfw-wj83 - Exploit, Vendor Advisory

07 Aug 2025, 15:15

Type Values Removed Values Added
References () https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-phfx-rjfw-wj83 - () https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-phfx-rjfw-wj83 -
Summary
  • (es) Himmelblau es una suite de interoperabilidad para Microsoft Azure Entra ID e Intune. En las versiones 0.8.0 a 0.9.21 y 1.0.0-beta a 1.1.0, Himmelblau almacena el TGT de la nube recibido al iniciar sesión en la caché de credenciales de Kerberos. La colección de caché de credenciales creada y las credenciales recibidas se almacenan como legibles para todo el mundo. Esto se solucionó en las versiones 0.9.22 y 1.2.0. Para solucionar este problema, elimine el acceso de lectura a las cachés de Himmelblau para todos los usuarios, excepto para los propietarios.

07 Aug 2025, 01:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-07 01:15

Updated : 2025-10-09 17:36

NVD link : CVE-2025-54882

Mitre link : CVE-2025-54882

CVE.ORG link : CVE-2025-54882

JSON object : View

Products Affected

himmelblau-idm

  • himmelblau
CWE
CWE-522

Insufficiently Protected Credentials