Base Score

HIGH8

CVE-2025-49653

Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform.

VectorNETWORK

Published By6f8de1f0-f67e-45a6-b68f-98777fdb759c

Published DateJun 09, 2025, 18:15

Affected Versions(1)

backend.ai(PyPI)

Introduced0

FixedN/A

LimitN/A

Package (Ecosystem)	Introduced	Fixed	Limit
backend.ai(PyPI)	0	N/A	N/A

Weakness Type (CWE):CWE-200

CVSS Metrics

Base Score

Vector String

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Base Severity

HIGH

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

HIGH

Privileges Required (PR)

HIGH

User Interaction (UI)

NONE

Scope (S)

CHANGED

Confidentiality (C)

HIGH

Integrity (I)

HIGH

Availability (A)

HIGH

References

https://hiddenlayer.com/sai_security_advisor/2025-06-backendai/

Base Score

HIGH8

Weakness Type (CWE):CWE-200

CVSS Metrics

Base Score

Vector String

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Base Severity

HIGH

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

HIGH

Privileges Required (PR)

HIGH

User Interaction (UI)

NONE

Scope (S)

CHANGED

Confidentiality (C)

HIGH

Integrity (I)

HIGH

Availability (A)

HIGH