How severe is CVE-2025-24034?

This vulnerability has a severity rating of LOW with a CVSS score of 3.2 out of 10.

What type of vulnerability is CVE-2025-24034?

This is classified as CWE-532, which is a common weakness in software security.

CVE-2025-24034 - LOW Severity | CVSS 3.2

Vulnerability Description

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Starting in version 0.7.0 and prior to versions 0.7.15 and 0.8.3, Himmelblau is vulnerable to leaking credentials in debug logs. When debug logging is enabled, user access tokens are inadvertently logged, potentially exposing sensitive authentication data. Similarly, Kerberos Ticket-Granting Tickets (TGTs) are logged when debug logging is enabled. Both issues pose a risk of exposing sensitive credentials, particularly in environments where debug logging is enabled. Himmelblau versions 0.7.15 and 0.8.3 contain a patch that fixes both issues. Some workarounds are available for users who are unable to upgrade. For the **logon compliance script issue**, disable the `logon_script` option in `/etc/himmelblau/himmelblau.conf`, and avoid using the `-d` flag when starting the `himmelblaud` daemon. For the Kerberos CCache issue, one may disable debug logging globally by setting the `debug` option in `/etc/himmelblau/himmelblau.conf` to `false` and avoiding the `-d` parameter when starting `himmelblaud`.

Related Vulnerabilities

CVE-2016-0296

LOW

CVSS:3.3(Low)

IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) stores potentially sensitive information in log files that could be available to a local user.

CWE-5322016

CVE-2016-5432

LOW

CVSS:3.3(Low)

The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files.

CWE-5322016

CVE-2017-1733

LOW

CVSS:3.3(Low)

IBM QRadar 7.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 134914.

CWE-5322017

CVE-2017-18423

LOW

CVSS:3.3(Low)

In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273).

CWE-5322017

CVE-2018-5693

LOW

CVSS:3.3(Low)

The LinuxMagic MagicSpam extension before 2.0.14-1 for Plesk allows local users to discover mailbox names by reading /var/log/magicspam/mslog.

CWE-5322018

CVE-2019-10343

LOW

CVSS:3.3(Low)

Jenkins Configuration as Code Plugin 1.24 and earlier did not properly apply masking to values expected to be hidden when logging the configuration being applied.

CWE-5322019