{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "title": "Fedora Repository fedoraIntCallUser default credentials and insecure archive extraction",
    "tracking": {
      "current_release_date": "2025-01-23T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.17"
        },
        "date": "2025-01-23T20:08:19Z"
      },
      "id": "VA-25-021-01",
      "initial_release_date": "2025-01-23T00:00:00Z",
      "status": "final",
      "version": "1.0.0",
      "revision_history": [
        {
          "number": "1.0.0",
          "summary": "Initial publication",
          "date": "2025-01-23T00:00:00Z"
        }
      ]
    },
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "text": "Fedora Repository 3.8 includes default user credentials and allows path traversal when extracting uploaded archive files. An attacker can exploit these vulnerabilities to read sensitive data and execute arbitrary commands with the privileges of the Java web application server. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained.\n",
        "title": "Risk Evaluation",
        "category": "summary"
      },
      {
        "text": "All information products included in https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice",
        "category": "legal_disclaimer"
      },
      {
        "text": "Worldwide",
        "title": "Countries and Areas Deployed",
        "category": "other"
      },
      {
        "text": "Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. No remediation will be provided for these vulnerabilities. [Migrate](https://github.com/fcrepo-exts/migration-utils) to a currently supported version (6.5.1 as of 2025-01-23).",
        "title": "Recommended Practices",
        "category": "general"
      },
      {
        "text": "United States",
        "title": "Company Headquarters Location",
        "category": "other"
      },
      {
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors",
        "category": "description"
      }
    ],
    "references": [
      {
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-021-01.json",
        "summary": "Vulnerability Advisory VA-25-021-01 CSAF",
        "category": "self"
      }
    ]
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Fedora Repository",
        "branches": [
          {
            "category": "product_name",
            "name": "Fedora Repository",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<=3.8.1",
                "product": {
                  "name": "Fedora Repository Fedora Repository 0 <= 3.8.1",
                  "product_id": "CSAFPID-0001"
                }
              }
            ]
          }
        ]
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-23011",
      "cwe": {
        "id": "CWE-23",
        "name": "Relative Path Traversal"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Fedora Repository 3.8.x allows path traversal when extracting uploaded archives (\"Zip Slip\"). A remote, authenticated attacker can upload a specially crafted archive that will extract an arbitrary JSP file to a location that can be executed by an unauthenticated GET request. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported version (6.5.1 as of 2025-01-23).",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:P/A:N/T:T/2025-01-08T16:16:12Z/"
        }
      ],
      "title": "Fedora Repository archive extraction path traversal",
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-021-01.json"
        },
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/fcrepo-exts/migration-utils"
        },
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/fcrepo/fcrepo/releases"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "remediations": [
        {
          "category": "no_fix_planned",
          "details": "Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. No remediation will be provided for these vulnerabilities. [Migrate](https://github.com/fcrepo-exts/migration-utils) to a currently supported version (6.5.1 as of 2025-01-23).",
          "url": "https://github.com/fcrepo-exts/migration-utils",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "Matthew Galligan"
          ],
          "organization": "CISA"
        }
      ],
      "release_date": "2025-01-23T00:00:00Z"
    },
    {
      "cve": "CVE-2025-23012",
      "cwe": {
        "id": "CWE-1392",
        "name": "Use of Default Credentials"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Fedora Repository 3.8.x includes a service account (fedoraIntCallUser) with default credentials and privileges to read read local files by manipulating datastreams. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported version (6.5.1 as of 2025-01-23).",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:P/A:Y/T:P/2025-01-23T19:26:24Z/"
        }
      ],
      "title": "Fedora Repository fedoraIntCallUser default credentials",
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-021-01.json"
        },
        {
          "category": "external",
          "summary": "wiki.lyrasis.org",
          "url": "https://wiki.lyrasis.org/display/FEDORA38/XACML+Policy+Enforcement#XACMLPolicyEnforcement-4.1fedora-usersattributes"
        },
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/fcrepo-exts/migration-utils"
        },
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/fcrepo/fcrepo/releases"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "remediations": [
        {
          "category": "no_fix_planned",
          "details": "Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. No remediation will be provided for these vulnerabilities. [Migrate](https://github.com/fcrepo-exts/migration-utils) to a currently supported version (6.5.1 as of 2025-01-23).",
          "url": "https://github.com/fcrepo-exts/migration-utils",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "Matthew Galligan"
          ],
          "organization": "CISA"
        }
      ],
      "release_date": "2025-01-23T00:00:00Z"
    }
  ]
}