{"id":"CVE-2025-58445","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-58445","generatedAt":"2026-10-28T00:18:37.690Z","title":"All versions of Atlantis publicly expose detailed version information through its /status endpoint.","description":"Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. All versions of Atlantis publicly expose detailed version information through its /status endpoint. This information disclosure could allow attackers to identify and target known vulnerabilities associated with the specific versions, potentially compromising the service's security posture. This issue does not currently have a fix.","published":"2025-09-06T20:15:30.000Z","lastModified":"2026-06-17T09:44:28.000Z","status":"Analyzed","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"4.0","score":6.9,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-200"],"affected":["runatlantis/atlantis"],"epss":{"score":0.00456,"percentile":0.39362,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.46%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/runatlantis/atlantis/security/advisories/GHSA-xh7v-965r-23f7","tags":["Exploit","Vendor Advisory"],"source":"security-advisories@github.com"},{"url":"https://github.com/runatlantis/atlantis/security/advisories/GHSA-xh7v-965r-23f7","tags":["Exploit","Vendor Advisory"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-58445","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}