Product:
Windows StateRepository API
Summary
The Windows StateRepository API has a vulnerability that allows an authorized attacker to insert sensitive information into log files. This can lead to the disclosure of sensitive information locally. The issue arises due to improper handling of sensitive data in logs.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2025-59203 |
Exploitation
To exploit this vulnerability, an attacker with local access can manipulate the logging mechanism of the Windows StateRepository API. By executing specific commands or actions that trigger logging, the attacker can cause sensitive information to be written to log files, which can then be accessed by unauthorized users.
Affected Products
- Windows StateRepository API: Vulnerable to local information disclosure due to improper logging of sensitive data.
Mitigation
To mitigate this vulnerability, it is recommended to review and restrict access to log files generated by the Windows StateRepository API. Additionally, ensure that sensitive information is not logged or is properly sanitized before being written to logs.