CVE-2025-54583

Katalog CVE

CVSS 6.5 · Medium EPSS 0,46%

Kerentanan Incorrect Authorization pada finos gitproxy. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). Versions 1.19.1 and below allow users to push to remote repositories while bypassing policies and explicit approvals. Since checks and plugins are skipped, code containing secrets or unwanted changes could be pushed into a repository. This is fixed in version 1.19.2.

Rincian

Terbit di NVD

30 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3a patch
• https://github.com/finos/git-proxy/commit/bd2ecb2099cba21bca3941ee4d655d2eb887b3a9 patch
• https://github.com/finos/git-proxy/releases/tag/v1.19.2 patch · release notes
• https://github.com/finos/git-proxy/security/advisories/GHSA-qr93-8wwf-22g4 exploit · advisory pihak ketiga