CVE-2025-27221
Published: 04 March 2025
Summary
CVE-2025-27221 is a low-severity Improper Removal of Sensitive Information Before Storage or Transfer (CWE-212) vulnerability in Ruby-Lang Uri. Its CVSS base score is 3.2 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Credential Access (T1212); ranked at the 35.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5508
Vulnerability details
In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability in URI handling causes inadvertent retention and leakage of authentication credentials (userinfo) even after host changes, enabling adversaries to exploit it for credential access.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Eradication of spilled information from contaminated systems mitigates the effects of improper removal of sensitive data before storage or transfer.
The control requires verified removal of sensitive data before media is made available at a reduced classification level, directly addressing improper removal prior to storage or transfer.
Explicit procedures to delete inaccurate or outdated PII directly mitigate improper removal of sensitive information before storage or transfer.
Retention policies enforce removal or sanitization of sensitive data before storage or transfer per regulatory requirements.
The explicit requirement to delete inaccurate/outdated PII implements proper removal of sensitive information before further storage or transfer.
The control implements proper removal of sensitive information before storage or transfer of datasets.
The generate-on-demand-and-delete requirement enforces removal of sensitive information before storage or transfer, preventing improper retention.
Requires explicit removal of sensitive information prior to component transfer or disposal, reducing exposure from retained data.