In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux user account that is running oxidized-web.
References
| Link | Resource |
|---|---|
| https://github.com/ytti/oxidized-web/commit/a5220a0ddc57b85cd122bffee228d3ed4901668e | Patch |
| https://github.com/ytti/oxidized-web/releases/tag/0.15.0 | Release Notes |
Configurations
History
07 Mar 2025, 19:37
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Oxidized Web Project
Oxidized Web Project oxidized Web |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| References | () https://github.com/ytti/oxidized-web/releases/tag/0.15.0 - Release Notes | |
| References | () https://github.com/ytti/oxidized-web/commit/a5220a0ddc57b85cd122bffee228d3ed4901668e - Patch | |
| CWE | NVD-CWE-noinfo | |
| CPE | cpe:2.3:a:oxidized_web_project:oxidized_web:*:*:*:*:*:oxidized:*:* |
03 Mar 2025, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-03 04:15
Updated : 2025-03-07 19:37
NVD link : CVE-2025-27590
Mitre link : CVE-2025-27590
JSON object : View
Products Affected
oxidized_web_project
- oxidized_web
CWE