Vulnerability · Published Jun 5, 2025 · Assigned by GitHub_M
CVE-2025-49009Para Inserts Sensitive Information into Log File for Facebook authentication
Medium 6.2
In plain English
A medium-severity sensitive data in logs in para from Erudika. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 in `FacebookAuthFilter.java` results in a full request URL being logged during a failed request to a Facebook user profile. The log includes the user's access token in plain text. Since WARN-level logs are often retained in production and accessible to operators or log aggregation systems, this poses a risk of token exposure. Version 1.50.8 fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.erudika:para-server | 1.50.8 | GHSA-qx7g-fx8q-545g |
Affected products (as reported)
Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N