Erudika para up to 1.50.7 FacebookAuthFilter.java log file

Summaryinfo

A vulnerability was found in Erudika para up to 1.50.7. It has been declared as problematic. Affected by this issue is some unknown functionality of the file FacebookAuthFilter.java. The manipulation results in log file. This vulnerability was named CVE-2025-49009. The attack needs to be approached locally. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Erudika para up to 1.50.7. Affected is some unknown processing of the file FacebookAuthFilter.java. The manipulation with an unknown input leads to a log file vulnerability. CWE is classifying the issue as CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. This is going to have an impact on confidentiality. CVE summarizes:

Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 in `FacebookAuthFilter.java` results in a full request URL being logged during a failed request to a Facebook user profile. The log includes the user's access token in plain text. Since WARN-level logs are often retained in production and accessible to operators or log aggregation systems, this poses a risk of token exposure. Version 1.50.8 fixes the issue.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-49009 since 05/29/2025. The exploitability is told to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 1.50.8 eliminates this vulnerability. Applying the patch 46a908d887da02037384193f70a69345f04887cf is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-17008). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Erudika

Name

• para

Version

• 1.50.0
• 1.50.1
• 1.50.2
• 1.50.3
• 1.50.4
• 1.50.5
• 1.50.6
• 1.50.7

License

• open-source

Website

• Product: https://github.com/Erudika/para/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion