CVE-2025-64299
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
LogStare Collector improperly handles password hash data, allowing an administrative user to obtain other users' password hashes. The vulnerability concerns improper management of authentication data.
Risk Assessment
An administrator could obtain other users' password hashes, potentially enabling offline password cracking. This could lead to account takeover and privilege escalation.
Recommendation
Update LogStare Collector to a patched version or restrict administrative privileges. Consider forcing password changes for users whose hashes may have been exposed.
Other vulnerabilities in LogStare Collector
See all- CVE-2025-64695High
Uncontrolled search path element issue exists in the installer of LogStare Collector (for Windows). If exploited, arbitrary code may be executed with the privilege of the user invoking the installer.
- CVE-2025-62687Medium
A cross-site request forgery vulnerability exists in LogStare Collector. If a logged-in user views a crafted page, unintended operations may be performed.
- CVE-2025-62189Medium
LogStare Collector contains an incorrect authorization vulnerability in UserRegistration. A non-administrative user may create a new user account by sending a crafted HTTP request.
- CVE-2025-61949Medium
LogStare Collector contains a stored cross-site scripting vulnerability in UserManagement. If crafted user information is stored, an arbitrary script may be executed in the web browser of the user who logs in to the product's management page.
- CVE-2025-58097High
The installation directory of LogStare Collector is configured with incorrect access permissions. A non-administrative user may manipulate files within the installation directory and execute arbitrary code with administrative privileges.
Original NVD description (English source)
LogStare Collector improperly handles the password hash data. An administrative user may obtain the other users' password hashes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS