CVE-2025-71458

Overview

FTS3 Web Monitoring versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated SQL injection vulnerability in the /linkinfo endpoint. This flaw allows remote attackers to extract sensitive data, including cloud storage credentials and token provider client secrets, via blind injection through specific query parameters.

Description

FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection vulnerability in the /linkinfo endpoint handled by get_linkinfo. Remote attackers can inject SQL through the source_se and dest_se query parameters to perform blind injection and read stored cloud storage credentials and token provider client secrets.

Impact

The vulnerability compromises the confidentiality of the system by exposing stored cloud storage credentials and token provider client secrets. Since the endpoint is unauthenticated, any remote actor with network access can exploit this to gain unauthorized access to backend infrastructure. Integrity and availability are not directly impacted by the injection itself, but the leaked secrets may lead to secondary breaches. Organizations relying on this monitoring tool for infrastructure visibility face significant risk of lateral movement if credentials are compromised.

Remediation

Upgrade FTS3 Web Monitoring to a patched version released after 3.14.0. If immediate patching is not possible, restrict network access to the /linkinfo endpoint using firewall rules or web application firewall (WAF) policies. Implement input validation and parameterized queries in any custom integrations that interact with this endpoint. Monitor logs for anomalous requests to the /linkinfo endpoint, particularly those containing unusual query string patterns in source_se and dest_se parameters.

Risk context

The vulnerability is rated High severity with a CVSS v3 score of 7.5 and CVSS v4 score of 8.7. While no EPSS score is currently available, the unauthenticated nature and potential for credential theft warrant prompt attention. Defenders should prioritize remediation based on the exposure of the affected endpoint to untrusted networks.

Affected products

• FTS3 Web Monitoring 3.12.0
• FTS3 Web Monitoring 3.13.2
• FTS3 Web Monitoring 3.14.0