CVE-2025-54428 (CNNVD-202507-3561)
中文标题:
RevelaCode 安全漏洞
英文标题:
RevelaCode exposes Sensitive MongoDB Atlas URI in .env (potential credential leak)
漏洞描述
中文描述:
RevelaCode是Musombi William个人开发者的一个用于解读圣经经文的AI程序。 RevelaCode 1.0.1之前版本存在安全漏洞，该漏洞源于MongoDB Atlas URI泄露，可能导致数据库未授权访问。
英文描述:
RevelaCode is an AI-powered faith-tech project that decodes biblical verses, prophecies and global events into accessible language. In versions below 1.0.1, a valid MongoDB Atlas URI with embedded username and password was accidentally committed to the public repository. This could allow unauthorized access to production or staging databases, potentially leading to data exfiltration, modification, or deletion. This is fixed in version 1.0.1. Workarounds include: immediately rotating credentials for the exposed database user, using a secret manager (like Vault, Doppler, AWS Secrets Manager, etc.) instead of storing secrets directly in code, or auditing recent access logs for suspicious activity.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| musombi123 | RevelaCode-Backend | < 1.0.1 | - | - |
cpe:2.3:a:musombi123:revelacode-backend:<_1.0.1:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (cna)
CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-54428 |
2025-11-11 15:23:28 | 2025-11-11 07:40:42 |
| NVD | nvd_CVE-2025-54428 |
2025-11-11 15:00:57 | 2025-11-11 07:48:29 |
| CNNVD | cnnvd_CNNVD-202507-3561 |
2025-11-11 15:12:52 | 2025-11-11 08:00:02 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202507-3561
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']