Open-source package vulnerability · RubyGems
CVE-2025-27590: Oxidized Web RANCID migration page allows unauthenticated user to gain control over Linux user account
criticalCVSS 3.1 9.0GHSA-jx6p-9c26-g373
In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux user account that is running oxidized-web.
Published Mar 3, 2025
Affected packages
oxidized-web
- Ecosystem
- RubyGems
- Affected
- < 0.15.0
- Fixed in
- 0.15.0
- Check
bundle info oxidized-web
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux user account that is running oxidized-web.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology