{"id":"CVE-2025-71458","kind":"vulnerability","aliases":["CVE-2025-71458"],"related":[],"title":"FTS3 Web Monitoring: unauthenticated SQL injection leaks stored cloud credentials","description":"FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection vulnerability in the /linkinfo endpoint handled by get_linkinfo. Remote attackers can inject SQL through the source_se and dest_se query parameters to perform blind injection and read stored cloud storage credentials and token provider client secrets.","summary":"FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 have an unauthenticated SQL injection in the /linkinfo endpoint, reached through the source_se and dest_se query parameters. An attacker can use blind injection to read stored cloud storage credentials and token provider client secrets.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud-storage","fts-monitoring","fts3","other","self-hosted"],"not_affected_if":["endpoint-not-exposed","patched-version"],"how_to_check":"- Check the installed fts-monitoring version against `3.12.0` through `3.13.2` and `3.14.0`.\n- Look for the `/linkinfo` endpoint reachable from the network in the deployed monitoring service.","fix":"- Move to a fixed release listed in the linked patch and release notes; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-11-06T01:17:47+00:00","first_seen_at":"2026-11-06T01:19:01+00:00","triaged_at":"2026-11-06T01:19:19+00:00","updated_at":"2026-11-06T01:19:19+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-06T01:19:19Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a fixed release listed in the linked patch and release notes; the exact fixed version is unknown from the sources.","reach":"network","title":"FTS3 Web Monitoring: unauthenticated SQL injection leaks stored cloud credentials","impact":"high","summary":"FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 have an unauthenticated SQL injection in the /linkinfo endpoint, reached through the source_se and dest_se query parameters. An attacker can use blind injection to read stored cloud storage credentials and token provider client secrets.","audience":"businesses","category":"other","nicknames":[],"who_cares":["fts-monitoring","fts3","self-hosted","cloud-storage"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads stored cloud storage credentials and token client secrets","analyst_note":"Confirm the exact fixed version from the linked GitHub patch and release notes, and whether /linkinfo is reachable by default.","how_to_check":"- Check the installed fts-monitoring version against `3.12.0` through `3.13.2` and `3.14.0`.\n- Look for the `/linkinfo` endpoint reachable from the network in the deployed monitoring service.","plain_action":"","needs_analyst":true,"not_affected_if":["patched-version","endpoint-not-exposed"],"who_is_affected":"Teams running FTS3 Web Monitoring 3.12.0 through 3.13.2 or 3.14.0 that expose the /linkinfo endpoint are exposed. The flaw needs no account, and the stored cloud credentials it reads are the main risk. Deployments on a patched version, or where the endpoint is not reachable, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000769,"input_tokens":4361,"output_tokens":665,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2025':12A,15A '-71458':13A,16A '/linkinfo':47B,96C '3.12.0':35B,83C '3.13.2':37B,85C '3.14.0':39B,87C 'attack':60B,103C 'blind':63B,118C 'client':74B,129C 'cloud':9A,18B,68B,123C 'cloud-storag':17B 'contain':88C 'credenti':10A,70B,125C 'cve':11A,14A 'dest':55B,112C 'endpoint':48B,97C 'fts':21B,32B,80C 'fts-monitor':20B,31B,79C 'fts3':1A,23B,28B,76C 'get':100C 'handl':98C 'host':27B 'inject':6A,44B,64B,92C,105C,119C 'leak':7A 'linkinfo':101C 'monitor':3A,22B,30B,33B,78C,81C 'paramet':58B,115C 'perform':117C 'provid':73B,128C 'queri':57B,114C 'reach':49B 'read':66B,121C 'remot':102C 'se':53B,56B,110C,113C 'secret':75B,130C 'self':26B 'self-host':25B 'sourc':52B,109C 'sql':5A,43B,91C,106C 'storag':19B,69B,124C 'store':8A,67B,122C 'token':72B,127C 'unauthent':4A,42B,90C 'use':62B 'version':34B,82C 'vulner':93C 'web':2A,29B,77C","nicknames":[],"mitigations":[],"who_affected":"Teams running FTS3 Web Monitoring 3.12.0 through 3.13.2 or 3.14.0 that expose the /linkinfo endpoint are exposed. The flaw needs no account, and the stored cloud credentials it reads are the main risk. Deployments on a patched version, or where the endpoint is not reachable, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloudstorage","fts3","ftsmonitoring","high","other","selfhosted"],"campaign_type":null,"search_a":"'-2025':12A,15A '-71458':13A,16A 'cloud':9A 'credenti':10A 'cve':11A,14A 'fts3':1A 'inject':6A 'leak':7A 'monitor':3A 'sql':5A 'store':8A 'unauthent':4A 'web':2A","search_b":"'/linkinfo':47B '3.12.0':35B '3.13.2':37B '3.14.0':39B 'attack':60B 'blind':63B 'client':74B 'cloud':18B,68B 'cloud-storag':17B 'credenti':70B 'dest':55B 'endpoint':48B 'fts':21B,32B 'fts-monitor':20B,31B 'fts3':23B,28B 'host':27B 'inject':44B,64B 'monitor':22B,30B,33B 'paramet':58B 'provid':73B 'queri':57B 'reach':49B 'read':66B 'se':53B,56B 'secret':75B 'self':26B 'self-host':25B 'sourc':52B 'sql':43B 'storag':19B,69B 'store':67B 'token':72B 'unauthent':42B 'use':62B 'version':34B 'web':29B","search_c":"'/linkinfo':96C '3.12.0':83C '3.13.2':85C '3.14.0':87C 'attack':103C 'blind':118C 'client':129C 'cloud':123C 'contain':88C 'credenti':125C 'dest':112C 'endpoint':97C 'fts':80C 'fts-monitor':79C 'fts3':76C 'get':100C 'handl':98C 'inject':92C,105C,119C 'linkinfo':101C 'monitor':78C,81C 'paramet':115C 'perform':117C 'provid':128C 'queri':114C 'read':121C 'remot':102C 'se':110C,113C 'secret':130C 'sourc':109C 'sql':91C,106C 'storag':124C 'store':122C 'token':127C 'unauthent':90C 'version':82C 'vulner':93C 'web':77C","first_public_at":"2026-11-06T01:17:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-71458","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71458","severity":null,"published_at":"2026-11-06T01:17:47+00:00","modified_at":"2026-11-06T01:17:47+00:00","first_seen_at":"2026-11-06T01:19:01+00:00","fetched_at":"2026-11-06T01:19:01+00:00","note":null}],"documents":[{"id":82246,"url":"https://github.com/cern-fts/fts-monitoring/commit/96241f6e9911195aae8e9e07bce511da4e81fc08","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":82247,"url":"https://github.com/cern-fts/fts-monitoring/commit/e993c27d60a150c67cc2b415ddb272b5d3f05596","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":82248,"url":"https://github.com/cern-fts/fts-monitoring/releases/tag/v3.13.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":82249,"url":"https://github.com/cern-fts/fts-monitoring/releases/tag/v3.14.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":82250,"url":"https://www.vulncheck.com/advisories/fts3-web-monitoring-3.12.0-through-3.13.2-and-3.14.0-sql-injection-via-linkinfo","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}