GHSA-xm8v-g828-5x9r

Опубликовано: 06 июл. 2025

Источник: github

Github: Не прошло ревью

CVSS3: 7.8

Описание

Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner).

Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges. This issue affects Apache APISIX(java-plugin-runner): from 0.2.0 through 0.5.0.

Users are recommended to upgrade to version 0.6.0 or higher, which fixes the issue.

Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner).

Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges. This issue affects Apache APISIX(java-plugin-runner): from 0.2.0 through 0.5.0.

Users are recommended to upgrade to version 0.6.0 or higher, which fixes the issue.

Ссылки

EPSS

Процентиль: 2%

0.00014

Низкий

7.8 High

CVSS3

CVE ID

CVE-2025-27446

Дефекты

CWE-732

Связанные уязвимости

CVE-2025-27446

CVSS3: 7.8

nvd

7 месяцев назад

Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner). Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges. This issue affects Apache APISIX(java-plugin-runner): from 0.2.0 through 0.5.0. Users are recommended to upgrade to version 0.6.0 or higher, which fixes the issue.

BDU:2026-00212

CVSS3: 5.3

fstec

10 месяцев назад

Уязвимость плагина java-plugin-runner облачного API-шлюза Apache APISIX, позволяющая нарушителю повысить свои привилегии

EPSS

Процентиль: 2%

0.00014

Низкий

7.8 High

CVSS3

CVE ID

CVE-2025-27446

Дефекты

CWE-732