CVE-2025-9127 - Vulnerability Details - OpenCVE

A vulnerability exists in PX Enterprise whereby sensitive information may be logged under specific conditions.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Purestorage	Px Enterprise

No data.

No data.

References

Link	Providers
https://support.purestorage.com/category/m_pure_storage_product_security

History

Fri, 05 Dec 2025 11:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Purestorage Purestorage px Enterprise
Vendors & Products		Purestorage Purestorage px Enterprise

Thu, 04 Dec 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 04 Dec 2025 18:15:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability exists in PX Enterprise whereby sensitive information may be logged under specific conditions.
Title		PX Enterprise Improper Sanitization Vulnerability
Weaknesses		CWE-116
References		https://support.purestorage.com/category/m_pure_storage_product_security
Metrics		cvssV4_0 `{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H'}`

MITRE

Status: PUBLISHED

Assigner: PureStorage

Published: 2025-12-04T17:59:39.985Z

Updated: 2025-12-04T20:00:49.889Z

Reserved: 2025-08-18T19:54:46.984Z

Link: CVE-2025-9127

Vulnrichment

Updated: 2025-12-04T18:55:06.465Z

NVD

Status : Received

Published: 2025-12-04T18:15:51.603

Modified: 2025-12-04T18:15:51.603

Link: CVE-2025-9127

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9127", "assignerOrgId": "3895c224-4e1d-482a-adb3-fa64795683ac", "state": "PUBLISHED", "assignerShortName": "PureStorage", "dateReserved": "2025-08-18T19:54:46.984Z", "datePublished": "2025-12-04T17:59:39.985Z", "dateUpdated": "2025-12-04T20:00:49.889Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "PX Enterprise", "vendor": "Pure Storage", "versions": [{"status": "affected", "version": "3.3.0, 3.3.1, 3.3.1.1, 3.3.1.2", "versionType": "custom"}, {"status": "affected", "version": "3.2.0, 3.2.1, 3.2.2, 3.2.3", "versionType": "custom"}, {"lessThanOrEqual": "3.1.8", "status": "affected", "version": "3.1.1", "versionType": "custom"}, {"status": "affected", "version": "2.13.12", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A vulnerability exists in PX Enterprise whereby sensitive information may be logged under specific conditions.</span><br>"}], "value": "A vulnerability exists in PX Enterprise whereby sensitive information may be logged under specific conditions."}], "impacts": [{"capecId": "CAPEC-268", "descriptions": [{"lang": "en", "value": "CAPEC-268 Audit Log Manipulation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 8.4, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-116", "description": "CWE-116 Improper Encoding or Escaping of Output", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "3895c224-4e1d-482a-adb3-fa64795683ac", "shortName": "PureStorage", "dateUpdated": "2025-12-04T17:59:39.985Z"}, "references": [{"url": "https://support.purestorage.com/category/m_pure_storage_product_security"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>This issue is resolved in the following PX Enterprise releases:</p><div><ul><li><p>Portworx Enterprise 3.1.9 or later</p></li><li><p>Portworx Enterprise 3.2.4 or later</p></li><li><p>Portworx Enterprise 3.3.1.3 or later</p></li></ul></div><br>"}], "value": "This issue is resolved in the following PX Enterprise releases:\n\n * Portworx Enterprise 3.1.9 or later\n\n\n * Portworx Enterprise 3.2.4 or later\n\n\n * Portworx Enterprise 3.3.1.3 or later"}], "source": {"discovery": "INTERNAL"}, "title": "PX Enterprise Improper Sanitization Vulnerability", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-04T18:55:05.404762Z", "id": "CVE-2025-9127", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-04T20:00:49.889Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9127", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-04T18:55:05.404762Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-04T18:55:06.465Z"}}], "cna": {"title": "PX Enterprise Improper Sanitization Vulnerability", "source": {"discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-268", "descriptions": [{"lang": "en", "value": "CAPEC-268 Audit Log Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Pure Storage", "product": "PX Enterprise", "versions": [{"status": "affected", "version": "3.3.0, 3.3.1, 3.3.1.1, 3.3.1.2", "versionType": "custom"}, {"status": "affected", "version": "3.2.0, 3.2.1, 3.2.2, 3.2.3", "versionType": "custom"}, {"status": "affected", "version": "3.1.1", "versionType": "custom", "lessThanOrEqual": "3.1.8"}, {"status": "affected", "version": "2.13.12", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "This issue is resolved in the following PX Enterprise releases:\n\n * Portworx Enterprise 3.1.9 or later\n\n\n * Portworx Enterprise 3.2.4 or later\n\n\n * Portworx Enterprise 3.3.1.3 or later", "supportingMedia": [{"type": "text/html", "value": "<p>This issue is resolved in the following PX Enterprise releases:</p><div><ul><li><p>Portworx Enterprise 3.1.9 or later</p></li><li><p>Portworx Enterprise 3.2.4 or later</p></li><li><p>Portworx Enterprise 3.3.1.3 or later</p></li></ul></div><br>", "base64": false}]}], "references": [{"url": "https://support.purestorage.com/category/m_pure_storage_product_security"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability exists in PX Enterprise whereby sensitive information may be logged under specific conditions.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A vulnerability exists in PX Enterprise whereby sensitive information may be logged under specific conditions.</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116 Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "3895c224-4e1d-482a-adb3-fa64795683ac", "shortName": "PureStorage", "dateUpdated": "2025-12-04T17:59:39.985Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9127", "state": "PUBLISHED", "dateUpdated": "2025-12-04T20:00:49.889Z", "dateReserved": "2025-08-18T19:54:46.984Z", "assignerOrgId": "3895c224-4e1d-482a-adb3-fa64795683ac", "datePublished": "2025-12-04T17:59:39.985Z", "assignerShortName": "PureStorage"}, "dataVersion": "5.2"}