2 lines
2.8 KiB
JSON
2 lines
2.8 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Tooling","repo":"https://github.com/hashicorp-forge/hermes","vendor":"HashiCorp","versions":[{"lessThan":"0.5.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@hashicorp.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:hashicorp:hermes:*:*:*:*:*:*:*:*","matchCriteriaId":"CFD018EE-EB24-4ADF-BAAB-624B6CAB0198","versionEndExcluding":"0.5.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0."},{"lang":"es","value":"Las versiones de Hermes de hasta 0.4.0 validaron incorrectamente el JWT proporcionado cuando se usa el modo de autenticación AWS Alb, lo que puede permitir el bypass de autenticación. Esta vulnerabilidad, CVE-2025-1293, se fijó en Hermes 0.5.0."}],"id":"CVE-2025-1293","lastModified":"2026-06-17T08:38:45.550","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"security@hashicorp.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-1293","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-02-20T14:23:52.485758Z","version":"2.0.3"}}]},"published":"2025-02-20T01:15:09.950","references":[{"source":"security@hashicorp.com","tags":["Vendor Advisory"],"url":"https://discuss.hashicorp.com/t/hcsec-2025-03-hashicorp-hermes-improperly-validates-aws-alb-jwts-which-may-lead-to-authentication-bypass/73371"}],"sourceIdentifier":"security@hashicorp.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-1390"}],"source":"security@hashicorp.com","type":"Secondary"}]}
|