CVE-2025-14758 - Vulnerability Details - OpenCVE

Incorrect configuration of replication security in the MariaDB component of the infra-operator in YAOOK Operator allows an on-path attacker to read database contents, potentially including credentials

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00019.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Alasca Subscribe	Yaook Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products
Alasca Subscribe	Yaook Subscribe

Advisories

No advisories yet.

Fixes

Solution

Upgrade to 0.20251211.0 or later

Workaround

No workaround given by the vendor.

References

Link	Providers
https://gitlab.com/yaook/operator/-/issues/631

History

Tue, 16 Dec 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 16 Dec 2025 17:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Alasca Alasca yaook
Vendors & Products		Alasca Alasca yaook

Tue, 16 Dec 2025 00:45:00 +0000

Type	Values Removed	Values Added
Description		Incorrect configuration of replication security in the MariaDB component of the infra-operator in YAOOK Operator allows an on-path attacker to read database contents, potentially including credentials
Title		Initialization of a Resource with an Insecure Default in YAOOK
Weaknesses		CWE-1188
References		https://gitlab.com/yaook/operator/-/issues/631
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: GitLab

Published: 2025-12-16T00:33:32.971Z

Updated: 2025-12-16T21:22:55.691Z

Reserved: 2025-12-16T00:04:53.100Z

Link: CVE-2025-14758

Vulnrichment

Updated: 2025-12-16T21:22:52.371Z

NVD

Status : Awaiting Analysis

Published: 2025-12-16T01:15:47.267

Modified: 2025-12-16T14:10:11.300

Link: CVE-2025-14758

Redhat

No data.

OpenCVE Enrichment

Updated: 2025-12-16T17:09:33Z

Weaknesses

CWE-1188

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14758", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2025-12-16T00:04:53.100Z", "datePublished": "2025-12-16T00:33:32.971Z", "dateUpdated": "2025-12-16T21:22:55.691Z"}, "containers": {"cna": {"title": "Initialization of a Resource with an Insecure Default in YAOOK", "descriptions": [{"lang": "en", "value": "Incorrect configuration of replication security in the MariaDB component of the infra-operator in YAOOK Operator allows an on-path attacker to read database contents, potentially including credentials"}], "affected": [{"vendor": "ALASCA", "product": "YAOOK", "versions": [{"version": "0.20240809.0", "status": "affected", "lessThan": "0.20251211.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-1188: Initialization of a Resource with an Insecure Default", "cweId": "CWE-1188", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/yaook/operator/-/issues/631", "name": "GitLab Issue #631", "tags": ["issue-tracking", "permissions-required"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Upgrade to 0.20251211.0 or later"}], "credits": [{"lang": "en", "value": "@martinmo, @maximilian.brandt", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2025-12-16T00:33:32.971Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-16T21:17:57.934250Z", "id": "CVE-2025-14758", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-16T21:22:55.691Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14758", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-16T21:17:57.934250Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-16T21:22:52.371Z"}}], "cna": {"title": "Initialization of a Resource with an Insecure Default in YAOOK", "credits": [{"lang": "en", "type": "finder", "value": "@martinmo, @maximilian.brandt"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ALASCA", "product": "YAOOK", "versions": [{"status": "affected", "version": "0.20240809.0", "lessThan": "0.20251211.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to 0.20251211.0 or later"}], "references": [{"url": "https://gitlab.com/yaook/operator/-/issues/631", "name": "GitLab Issue #631", "tags": ["issue-tracking", "permissions-required"]}], "descriptions": [{"lang": "en", "value": "Incorrect configuration of replication security in the MariaDB component of the infra-operator in YAOOK Operator allows an on-path attacker to read database contents, potentially including credentials"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1188", "description": "CWE-1188: Initialization of a Resource with an Insecure Default"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2025-12-16T00:33:32.971Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14758", "state": "PUBLISHED", "dateUpdated": "2025-12-16T21:22:55.691Z", "dateReserved": "2025-12-16T00:04:53.100Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2025-12-16T00:33:32.971Z", "assignerShortName": "GitLab"}, "dataVersion": "5.2"}