Riskcovery

CVE-2025-12148

Unauthorized access to fields protected by Field Masking (FM) for fields of type IP

State
Published
Severity
6.0 Medium
Published
Oct 29, 2025
Updated
Oct 29, 2025
Reserved
Oct 24, 2025

Read the record on cve.org

Description

In Search Guard versions 3.1.1 and earlier, Field Masking (FM) rules are improperly enforced on fields of type IP (IP Address).

While the content of these fields is properly redacted in the _source document returned by search operations, the results do return documents (hits) when searching based on a specific IP values. This allows to reconstruct the original contents of the field.

Workaround - If you cannot upgrade immediately, you can avoid the problem by using field level security (FLS) protection on fields of the affected types instead of field masking.

Scores

CVSSScoreVectorSource
4.06.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:Nfloragunn

Weaknesses

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-732 Incorrect Permission Assignment for Critical Resource

Affected Products

ProductVersions
Search Guard FLXfloragunn
  • 1.0.0 through 3.1.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.