CVE-2025-48927 is a critical vulnerability affecting the TeleMessage service, specifically its Spring Boot Actuator configuration. It exposes a heap dump endpoint at the /heapdump URI, potentially leading to information disclosure. With a CVSS score of 5.3 (MEDIUM), this vulnerability is easily exploitable over the network without authentication, allowing an attacker to access sensitive data. Notably, it is actively exploited in the wild, as confirmed by its presence in the KEV catalog, and has garnered significant community discussion and media coverage, despite the lack of public exploit code.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:smarsh:telemessage:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.