CVE-2023-2025 MEDIUM

CVE-2023-2025: Exposure of Sensitive Information in OpenBlue Enterprise Manager Data Collector

Vendor Johnson Controls
Product OpenBlue Enterprise Manager Data Collector
Weakness CWE-200 · Info exposure
Published May 18, 2023
Last update February 12, 2025
View on NVD All CVEs

CVSS base score

5.0/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

What the vulnerability does

01Description

OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 may expose sensitive information to an unauthorized user under certain circumstances.

Key dates

02Disclosure timeline

May 18, 2023 CVE published
February 12, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-29108 Authenticated SuiteCRM Users Can Retrieve The Password Hash of Any User CVE-2024-11299 Memberpress <= 1.11.37 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure CVE-2023-47668 WordPress Restrict Content Plugin <= 3.2.7 is vulnerable to Sensitive Data Exposure CVE-2026-41520 Cillium exposes sensitive information included in the cilium-bugtool debug archive CVE-2024-47824 Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room