CVE-2025-23012
Published: 23 January 2025
Summary
CVE-2025-23012 is a high-severity Use of Default Credentials (CWE-1392) vulnerability in Fedorarepository Fcrepo. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Default Accounts (T1078.001); ranked at the 29.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SA-22 (Unsupported System Components).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the known flaw in Fedora Repository 3.8.x by requiring timely installation of patches or migration to a supported version like 6.5.1.
Prohibits the use of unsupported and unmaintained system components such as Fedora Repository 3.8.1, mandating replacement to eliminate the vulnerability.
Requires changing default credentials for the fedoraIntCallUser service account, preventing exploitation via known default authenticators.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Default credentials on privileged service account directly enable use of default accounts for remote unauthenticated access; resulting arbitrary local file disclosure maps to data from local system.
NVD Description
Fedora Repository 3.8.x includes a service account (fedoraIntCallUser) with default credentials and privileges to read read local files by manipulating datastreams. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported version (6.5.1…
more
as of 2025-01-23).
Deeper analysisAI
CVE-2025-23012 is a vulnerability in Fedora Repository 3.8.x, including version 3.8.1 released on 2015-06-11, which is no longer maintained. The issue stems from a service account named fedoraIntCallUser that uses default credentials and has privileges allowing the reading of local files through manipulation of datastreams. It is classified under CWE-1392 with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Remote attackers require no privileges, authentication, or user interaction to exploit this over the network with low complexity. Successful exploitation enables high-impact confidentiality violations, such as arbitrary local file disclosure on the affected system.
Advisories recommend migrating to a currently supported version, such as 6.5.1 as of 2025-01-23. Supporting resources include migration utilities at https://github.com/fcrepo-exts/migration-utils, release notes at https://github.com/fcrepo/fcrepo/releases, a CSAF document at https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-021-01.json, and XACML policy enforcement details at https://wiki.lyrasis.org/display/FEDORA38/XACML+Policy+Enforcement#XACMLPolicyEnforcement-4.1fedora-usersattributes.
Details
- CWE(s)