GitHub Advisoryadvisory · RubyGems

GHSA-jx6p-9c26-g373 Oxidized Web RANCID migration page allows unauthenticated user to gain control over Linux user account

CRITICAL Published 2025-03-03 Modified 2025-03-03 Official page ↗
Aliases
CVE-2025-27590
Ecosystem
RubyGems
Packages
oxidized-web
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2025-03-03

Affected packages

• RubyGems oxidized-web: < 0.15.0 → fixed in 0.15.0

Description

In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux user account that is running oxidized-web.

Related

Alias · CVE (1)

  • CVE-2025-27590 In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References