CVE-2025-71458

{
  "etk_id": "ETK-2026-3688",
  "cve_id": "CVE-2025-71458",
  "display_id": "CVE-2025-71458",
  "ghsa_id": "GHSA-xf3h-4wh8-v749",
  "euvd_id": "EUVD-2025-211270",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated SQL injection in fts-monitoring",
  "summary": "FTS3 Web Monitoring's fts-monitoring package is affected in versions 3.12.0 through 3.13.2 and version 3.14.0. An unauthenticated remote attacker who can access the affected monitoring endpoint may exploit SQL injection to retrieve stored cloud-storage credentials and token-provider client secrets.",
  "mitigation": "Upgrade fts-monitoring to 3.13.3 or 3.14.1, as appropriate for your release branch. Restrict unauthenticated access to the monitoring service until the upgrade is complete.",
  "vendor": "cern-fts",
  "product": "fts-monitoring",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.12.0, < 3.13.3",
        ">= 3.14.0, < 3.14.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "3.13.3",
        "3.14.1"
      ],
      "package_name": "fts-monitoring",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 22.2208177,
  "t0_at": "2026-11-06T00:20:23.644000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-06T01:28:40.233748+00:00",
      "days": 0.04741423319444445,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T00:20:23.644000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-06T00:20:23.644000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T00:20:23.644000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71458"
    }
  }
}