VulnerabilityAnalyzed
CVE-2025-58445
All versions of Atlantis publicly expose detailed version information through its /status endpoint.
MEDIUM 6.9EPSS 0.46%
Does this matter?
Lower severity and a low EPSS score (0.46%). Track it; it rarely justifies an emergency change on its own.
Description
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. All versions of Atlantis publicly expose detailed version information through its /status endpoint. This information disclosure could allow attackers to identify and target known vulnerabilities associated with the specific versions, potentially compromising the service's security posture. This issue does not currently have a fix.
- CVSS 4.0
- 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.46% probability · 38th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- runatlantis/atlantis
- Source
- security-advisories@github.com
References
- https://github.com/runatlantis/atlantis/security/advisories/GHSA-xh7v-965r-23f7Exploit, Vendor Advisory
- https://github.com/runatlantis/atlantis/security/advisories/GHSA-xh7v-965r-23f7Exploit, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.