{"metadata": {"vulnerability": "ghsa-mm6v-68qp-f9fw", "count": 12, "kinds": {"milestone": 3, "sighting": 3, "kev": 0, "other": 6}}, "data": [{"timestamp": "2025-01-15T22:04:19Z", "date_only": false, "value": "2025-01-15T22:04:19Z", "kind": "milestone", "label": "Published", "source": "github", "record": "ghsa-mm6v-68qp-f9fw", "field": "published"}, {"timestamp": "2025-02-06T17:13:33.121Z", "date_only": false, "value": "2025-02-06T17:13:33.121Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5 \u00b7 CVE-2025-25286", "record": "CVE-2025-25286", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-02-13T00:36:55.558Z", "date_only": false, "value": "2025-02-13T00:36:55.558Z", "kind": "milestone", "label": "Published", "source": "cvelistv5 \u00b7 CVE-2025-25286", "record": "CVE-2025-25286", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-02-13T00:36:55.558Z", "date_only": false, "value": "2025-02-13T00:36:55.558Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2025-25286 / GitHub_M", "record": "CVE-2025-25286", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-02-13T01:08:08Z", "date_only": false, "value": "2025-02-13T01:08:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/4172", "record": "GHSA-MM6V-68QP-F9FW", "field": "creation_timestamp", "uuid": "21dff982-125a-4b11-a32d-22a203043f4d", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: GHSA-mm6v-68qp-f9fw\n\ud83d\udd25 CVSS Score: 9.8 (CVSS_V3)\n\ud83d\udd39 Description: ### Impact\n\nRemote code execution may be possible in web-accessible installations of Homarus in certain configurations.\n\n### Patches\n\nThe issue has been patched in `islandora/crayfish:4.1.0`\n\n### Workarounds\n\nThe exploit requires making a request against the Homarus's `/convert` endpoint; therefore, the ability to exploit is much reduced if the microservice is not directly accessible from the Internet, so: Prevent general access from the Internet from hitting Homarus.\n\nConfigure auth in Crayfish to be more strongly required, such that requests with `Authorization` headers that do not validate are rejected before the problematic CLI interpolation occurs.\n\n### References\n\n- XBOW-024-071\n\ud83d\udccf Published: 2025-01-15T22:04:19Z\n\ud83d\udccf Modified: 2025-02-13T00:44:33Z\n\ud83d\udd17 References:\n1. https://github.com/Islandora/Crayfish/security/advisories/GHSA-mm6v-68qp-f9fw\n2. https://github.com/Islandora/Crayfish/commit/64cb4cec688928798cc40e6f0a0e863d7f69fd89\n3. https://github.com/Islandora/Crayfish", "url": "https://t.me/DarkWebInformer_CVEAlerts/4172"}, {"timestamp": "2025-02-13T01:15:25Z", "date_only": false, "value": "2025-02-13T01:15:25Z", "kind": "other", "label": "Nvd published at", "source": "github", "record": "ghsa-mm6v-68qp-f9fw", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-02-13T03:00:57Z", "date_only": false, "value": "2025-02-13T03:00:57.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/r090prh8PzjJEh682vcQnlDcJfJK4dwz44titdcQaapqPXQ", "record": "GHSA-MM6V-68QP-F9FW", "field": "creation_timestamp", "uuid": "1225044c-2af4-4c8d-9135-4e5b7856a692"}, {"timestamp": "2025-02-13T15:07:56.475Z", "date_only": false, "value": "2025-02-13T15:07:56.475931Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 \u00b7 CVE-2025-25286 / CISA-ADP", "record": "CVE-2025-25286", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-02-13T15:08:05.551Z", "date_only": false, "value": "2025-02-13T15:08:05.551Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2025-25286", "record": "CVE-2025-25286", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-02-13T15:08:05.551Z", "date_only": false, "value": "2025-02-13T15:08:05.551Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2025-25286 / CISA-ADP", "record": "CVE-2025-25286", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-02-13T16:49:25Z", "date_only": false, "value": "2025-02-13T16:49:25Z", "kind": "other", "label": "Updated", "source": "github", "record": "ghsa-mm6v-68qp-f9fw", "field": "modified"}, {"timestamp": "2025-02-18T02:56:16.318Z", "date_only": false, "value": "2025-02-18T02:56:16.318906Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulns.bsky.social/post/3ligb6gmskk2g", "record": "GHSA-mm6v-68qp-f9fw", "field": "creation_timestamp", "uuid": "439f3adb-fdd4-489f-83a9-f1da4a62eff2", "url": "https://bsky.app/profile/vulns.bsky.social/post/3ligb6gmskk2g"}]}