CVE-2025-58713
Redhat Process Automation Manager 7.0
Raw vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-58713 is a medium-severity Incorrect Default Permissions (CWE-276) vulnerability in Redhat Process Automation Manager. Its CVSS base score is 6.4 (Medium).
Operationally, ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-6 (Least Privilege) and CM-6 (Configuration Settings) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209306
Vulnerability Data
A container privilege escalation flaw was found in certain Red Hat Process Automation Manager images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within…
more
an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents non-root processes from obtaining root-group membership or the ability to modify /etc/passwd by enforcing minimal privileges at container runtime.
Requires hardened configuration baselines that include correct (non-group-writable) permissions on /etc/passwd during image build.
Enforces discretionary access-control decisions on the passwd file so that only authorized subjects may alter it.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened baselines and configuration management explicitly require correct default file permissions.
Defining and enforcing least-privilege access permissions directly prevents overly permissive defaults at install time.
Lifecycle management can encompass permission settings, yet the control is too broad to specifically mitigate incorrect defaults.
Secure SDLC practices include establishing secure defaults, but address only the development-phase portion of the weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Standard templates that restrict access to utility programs and host parameter settings prevent the assignment of overly permissive default permissions on critical resources.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Windows Server 2016 (1 rule)
- V-224833 Permissions for program file directories must conform to minimum requirements. via CWE-276
Windows Server 2019 (2 rules)
- V-205735 Windows Server 2019 permissions for program file directories must conform to minimum requirements. via CWE-276
- V-205736 Windows Server 2019 permissions for the Windows installation directory must conform to minimum requirements. via CWE-276
Windows Server 2022 (2 rules)
- V-254252 Windows Server 2022 permissions for program file directories must conform to minimum requirements. via CWE-276
- V-254253 Windows Server 2022 permissions for the Windows installation directory must conform to minimum requirements. via CWE-276