Detections
Analytics

SCA: security update for github.com/traPtitech/traQ (GHSA-27r7-3m9x-r533)

medium Tenable Cloud Security Plugin ID 435097

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - traQ is a messenger application built for Digital Creators Club traP. Prior to version 3.25.0, a
 vulnerability exists where sensitive information, such as OAuth tokens, are recorded in log files when an
 error occurs during the execution of an SQL query. An attacker could intentionally trigger an SQL error by
 methods such as placing a high load on the database. This could allow an attacker who has the authority to
 view the log files to illicitly acquire the recorded sensitive information. This vulnerability has been
 patched in version 3.25.0. If upgrading is not possible, a temporary workaround involves reviewing access
 permissions for SQL error logs and strictly limiting access to prevent unauthorized users from viewing
 them. (CVE-2025-57813)

See Also

https://github.com/advisories/GHSA-27r7-3m9x-r533

Plugin Details

Severity: Medium

ID: 435097

Version: Revision 1.11

Type: Local

Family: SCA Checks

Published: 8/26/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.2

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 4.6

Vector: CVSS2#AV:N/AC:H/Au:M/C:C/I:C/A:N

CVSS Score Source: CVE-2025-57813

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/26/2025

Vulnerability Publication Date: 8/26/2025

Reference Information

CVE: CVE-2025-57813

cwe: CWE-532