CVE-2025-2489 - Insecure storage of sensitive information in NTFS Tool

Back Back to CVE browser

MEDIUM

Insecure storage of sensitive information in NTFS Tool

Published Mar 18, 2025

6.8

MEDIUM

CVSS 4.0

EPSS 0.16%

Description

Insecure information storage vulnerability in NTFS Tools version 3.5.1. Exploitation of this vulnerability could allow an attacker to know the application password, stored in /Users/user/Library/Application Support/ntfs-tool/config.json.

Affected products

Vendor NTFS Tool Product Ntfs tool Default
unaffected
Affected
- 3.5.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
NTFS Tool	Ntfs tool	unaffected	Affected 3.5.1

Remediation

Vendor solution

There is no reported solution at this time.

Weaknesses (1)

CWE-922

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-7567		Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-storage-sensitive-information-ntfs-tool

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner INCIBE

Published Mar 18, 2025

Updated Mar 18, 2025

Reserved Mar 18, 2025

Link CVE-2025-2489

CISA Vulnrichment

Updated Mar 18, 2025

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-2489

Red Hat

No data

ENISA EUVD

Assigner INCIBE

Published Mar 18, 2025

Updated Mar 18, 2025

Link EUVD-2025-7567

GitHub

No data