CVE-2025-13532 - Vulnerability Details - OpenCVE

Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms. This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

Upgrade to BoKS Server Agent 9.0.0.4.

Workaround

Configure the OS to use SHA512 rather than yescrypt.

References

Link	Providers
https://www.fortra.com/security/advisories/product-security/fi-2025-014

History

Tue, 16 Dec 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 16 Dec 2025 20:15:00 +0000

Type	Values Removed	Values Added
Description		Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms. This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain.
Title		Weak Password Hash in Core Privileged Access Manager (BoKS)
Weaknesses		CWE-916
References		https://www.fortra.com/security/advisories/product-security/fi-2025-014
Metrics		cvssV3_1 `{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: Fortra

Published: 2025-12-16T20:01:02.743Z

Updated: 2025-12-16T20:23:51.768Z

Reserved: 2025-11-21T21:04:44.245Z

Link: CVE-2025-13532

Vulnrichment

Updated: 2025-12-16T20:18:54.152Z

NVD

Status : Received

Published: 2025-12-16T20:15:47.467

Modified: 2025-12-16T20:15:47.467

Link: CVE-2025-13532

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-916

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13532", "assignerOrgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "state": "PUBLISHED", "assignerShortName": "Fortra", "dateReserved": "2025-11-21T21:04:44.245Z", "datePublished": "2025-12-16T20:01:02.743Z", "dateUpdated": "2025-12-16T20:23:51.768Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Core Privileged Access Manager (BoKS)", "vendor": "Fortra", "versions": [{"status": "affected", "version": "This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain. The affected platforms are: Debian 11, 12, 13, RedHat 9, 10 and Ubuntu 24."}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms.  <span style=\"background-color: rgb(255, 255, 255);\">This issue a</span><span style=\"background-color: rgb(255, 255, 255);\">ffects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain.</span>"}], "value": "Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms. \u00a0This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain."}], "impacts": [{"capecId": "CAPEC-112", "descriptions": [{"lang": "en", "value": "CAPEC-112 Brute Force"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-916", "description": "CWE-916 Use of Password Hash With Insufficient Computational Effort", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "shortName": "Fortra", "dateUpdated": "2025-12-16T20:01:02.743Z"}, "references": [{"url": "https://www.fortra.com/security/advisories/product-security/fi-2025-014"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upgrade to BoKS Server Agent 9.0.0.4.\n\n<br>"}], "value": "Upgrade to BoKS Server Agent 9.0.0.4."}], "source": {"discovery": "UNKNOWN"}, "title": "Weak Password Hash in Core Privileged Access Manager (BoKS)", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Configure the OS to use SHA512 rather than yescrypt.\n\n<br>"}], "value": "Configure the OS to use SHA512 rather than yescrypt."}], "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-16T20:18:38.616690Z", "id": "CVE-2025-13532", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-16T20:23:51.768Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13532", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-16T20:18:38.616690Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-16T20:18:54.152Z"}}], "cna": {"title": "Weak Password Hash in Core Privileged Access Manager (BoKS)", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-112", "descriptions": [{"lang": "en", "value": "CAPEC-112 Brute Force"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Fortra", "product": "Core Privileged Access Manager (BoKS)", "versions": [{"status": "affected", "version": "This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain. The affected platforms are: Debian 11, 12, 13, RedHat 9, 10 and Ubuntu 24."}], "platforms": ["Linux"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to BoKS Server Agent 9.0.0.4.", "supportingMedia": [{"type": "text/html", "value": "Upgrade to BoKS Server Agent 9.0.0.4.\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.fortra.com/security/advisories/product-security/fi-2025-014"}], "workarounds": [{"lang": "en", "value": "Configure the OS to use SHA512 rather than yescrypt.", "supportingMedia": [{"type": "text/html", "value": "Configure the OS to use SHA512 rather than yescrypt.\n\n<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms. \u00a0This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain.", "supportingMedia": [{"type": "text/html", "value": "Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms.  <span style=\"background-color: rgb(255, 255, 255);\">This issue a</span><span style=\"background-color: rgb(255, 255, 255);\">ffects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain.</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-916", "description": "CWE-916 Use of Password Hash With Insufficient Computational Effort"}]}], "providerMetadata": {"orgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "shortName": "Fortra", "dateUpdated": "2025-12-16T20:01:02.743Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13532", "state": "PUBLISHED", "dateUpdated": "2025-12-16T20:23:51.768Z", "dateReserved": "2025-11-21T21:04:44.245Z", "assignerOrgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "datePublished": "2025-12-16T20:01:02.743Z", "assignerShortName": "Fortra"}, "dataVersion": "5.2"}