CVE-2025-23012

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-23012
Fedora Repository 3.8.x includes a service account (fedoraIntCallUser) with default credentials and privileges to read read local files by manipulating datastreams. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported version (6.5.1 as of 2025-01-23).

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/fcrepo-exts/migration-utils Product
https://github.com/fcrepo/fcrepo/releases Release Notes
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-021-01.json Product
https://wiki.lyrasis.org/display/FEDORA38/XACML+Policy+Enforcement#XACMLPolicyEnforcement-4.1fedora-usersattributes Technical Description
Configurations

Configuration 1 (hide)

cpe:2.3:a:fedorarepository:fcrepo:*:*:*:*:*:*:*:*
History

07 Oct 2025, 16:47

Type Values Removed Values Added
References () https://github.com/fcrepo-exts/migration-utils - () https://github.com/fcrepo-exts/migration-utils - Product
References () https://github.com/fcrepo/fcrepo/releases - () https://github.com/fcrepo/fcrepo/releases - Release Notes
References () https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-021-01.json - () https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-021-01.json - Product
References () https://wiki.lyrasis.org/display/FEDORA38/XACML+Policy+Enforcement#XACMLPolicyEnforcement-4.1fedora-usersattributes - () https://wiki.lyrasis.org/display/FEDORA38/XACML+Policy+Enforcement#XACMLPolicyEnforcement-4.1fedora-usersattributes - Technical Description
First Time Fedorarepository
Fedorarepository fcrepo
CPE cpe:2.3:a:fedorarepository:fcrepo:*:*:*:*:*:*:*:*

03 Feb 2025, 20:15

Type Values Removed Values Added
Summary
  • (es) Fedora Repository 3.8.x incluye una cuenta de servicio (fedoraIntCallUser) con credenciales y privilegios predeterminados para leer archivos locales mediante la manipulación de flujos de datos. Fedora Repository 3.8.1 se lanzó el 11 de junio de 2015 y ya no se mantiene. Migre a una versión compatible actualmente (6.5.1 a partir del 23 de enero de 2025).

23 Jan 2025, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-23 21:15

Updated : 2025-10-07 16:47

NVD link : CVE-2025-23012

Mitre link : CVE-2025-23012

CVE.ORG link : CVE-2025-23012

JSON object : View

Products Affected

fedorarepository

  • fcrepo
CWE
CWE-1392