CVE-2025-20002 GMOD Apollo Generation of Error Message Containing Sensitive Information

MediumCVSS 6.9 EPSS 0.31%

Published: 2025-03-05 02:08
Updated: 2026-06-17 11:40
Exploit status: No public exploit known

Sign in for asset impact Search another CVE

Description

After attempting to upload a file that does not meet prerequisites, GMOD Apollo will respond with local path information disclosure

Affected products

Product	Affected versions	Fixed in
gmod Apollo	< 2.8.0	2.8.0

References

CVSS v4.0

6.9 Medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: Low
Vulnerable System Integrity: None
Vulnerable System Availability: None
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

All scores (4)

v4.0 6.9 · icscert
v4.0 6.9 · ics-cert@hq.dhs.gov
v3.1 5.3 · icscert
v3.1 5.3 · ics-cert@hq.dhs.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.31% (percentile 24.0)
CWE: CWE-209 Generation of Error Message Containing Sensitive Information

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.