CVE-2025-24369

Katalog CVE

CVSS 2.3 · Low EPSS 0,42%

Kerentanan Reliance on Untrusted Inputs in a Security Decision. Skor CVSS 4.0 2.3 (Low) menurut github.com.

Deskripsi (NVD)

Anubis is a tool that allows administrators to protect bots against AI scrapers through bot-checking heuristics and a proof-of-work challenge to discourage scraping from multiple IP addresses. Anubis allows attackers to bypass the bot protection by requesting a challenge, formulates any nonce (such as 42069), and then passes the challenge with difficulty zero. Commit e09d0226a628f04b1d80fd83bee777894a45cd02 fixes this behavior by not using a client-specified difficulty value.

Rincian

Terbit di NVD

27 Januari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 4.0

2.3 (Low), sumber github.com
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-807: Reliance on Untrusted Inputs in a Security Decision

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/Xe/x/commit/7bd7b209f4f1b897de85ec8973458dc8be606a8b
• https://github.com/Xe/x/commit/e09d0226a628f04b1d80fd83bee777894a45cd02
• https://github.com/Xe/x/security/advisories/GHSA-56w8-8ppj-2p4f
• https://xeiaso.net/notes/2025/GHSA-56w8-8ppj-2p4f