CVE-2025-24363

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-24363", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-01-20T15:18:26.990Z", "datePublished": "2025-01-24T18:54:44.179Z", "dateUpdated": "2025-01-24T19:19:20.046Z"}, "containers": {"cna": {"title": "The HL7 FHIR IG publisher may potentially expose GitHub repo user and credential information", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-6729-95v3-pjc2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-6729-95v3-pjc2"}, {"name": "https://github.com/HL7/fhir-ig-publisher/commit/d968694b7dd041640efab5414d7077d5028569f7", "tags": ["x_refsource_MISC"], "url": "https://github.com/HL7/fhir-ig-publisher/commit/d968694b7dd041640efab5414d7077d5028569f7"}, {"name": "https://github.com/HL7/fhir-ig-publisher/releases/tag/1.8.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/HL7/fhir-ig-publisher/releases/tag/1.8.9"}], "affected": [{"vendor": "HL7", "product": "fhir-ig-publisher", "versions": [{"version": "< 1.8.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-01-24T19:14:51.895Z"}, "descriptions": [{"lang": "en", "value": "The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.8.9, in CI contexts, the IG Publisher CLI uses git commands to determine the URL of the originating repo. If the repo was cloned, or otherwise set to use a repo that uses a username and credential based URL, the entire URL will be included in the built Implementation Guide, exposing username and credential. This does not impact users that clone public repos without credentials, such as those using the auto-ig-build continuous integration infrastructure. This problem has been patched in release 1.8.9. Some workarounds are available. Users should ensure the IG repo they are publishing does not have username or credentials included in the `origin` URL. Running the command `git remote origin url` should return a URL that contains no username, password, or token; or users should run the IG Publisher CLI with the `-repo` parameter and specify a URL that contains no username, password, or token."}], "source": {"advisory": "GHSA-6729-95v3-pjc2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-24T19:19:09.087937Z", "id": "CVE-2025-24363", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-24T19:19:20.046Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-24363", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-24T19:19:09.087937Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-24T19:19:15.480Z"}}], "cna": {"title": "The HL7 FHIR IG publisher may potentially expose GitHub repo user and credential information", "source": {"advisory": "GHSA-6729-95v3-pjc2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "HL7", "product": "fhir-ig-publisher", "versions": [{"status": "affected", "version": "< 1.8.9"}]}], "references": [{"url": "https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-6729-95v3-pjc2", "name": "https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-6729-95v3-pjc2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/HL7/fhir-ig-publisher/commit/d968694b7dd041640efab5414d7077d5028569f7", "name": "https://github.com/HL7/fhir-ig-publisher/commit/d968694b7dd041640efab5414d7077d5028569f7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/HL7/fhir-ig-publisher/releases/tag/1.8.9", "name": "https://github.com/HL7/fhir-ig-publisher/releases/tag/1.8.9", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.8.9, in CI contexts, the IG Publisher CLI uses git commands to determine the URL of the originating repo. If the repo was cloned, or otherwise set to use a repo that uses a username and credential based URL, the entire URL will be included in the built Implementation Guide, exposing username and credential. This does not impact users that clone public repos without credentials, such as those using the auto-ig-build continuous integration infrastructure. This problem has been patched in release 1.8.9. Some workarounds are available. Users should ensure the IG repo they are publishing does not have username or credentials included in the `origin` URL. Running the command `git remote origin url` should return a URL that contains no username, password, or token; or users should run the IG Publisher CLI with the `-repo` parameter and specify a URL that contains no username, password, or token."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-01-24T19:14:51.895Z"}}}, "cveMetadata": {"cveId": "CVE-2025-24363", "state": "PUBLISHED", "dateUpdated": "2025-01-24T19:19:20.046Z", "dateReserved": "2025-01-20T15:18:26.990Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-01-24T18:54:44.179Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "fhir-ig-publisher", "vendor": "HL7", "versions": [{"status": "affected", "version": "< 1.8.9"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.8.9, in CI contexts, the IG Publisher CLI uses git commands to determine the URL of the originating repo. If the repo was cloned, or otherwise set to use a repo that uses a username and credential based URL, the entire URL will be included in the built Implementation Guide, exposing username and credential. This does not impact users that clone public repos without credentials, such as those using the auto-ig-build continuous integration infrastructure. This problem has been patched in release 1.8.9. Some workarounds are available. Users should ensure the IG repo they are publishing does not have username or credentials included in the `origin` URL. Running the command `git remote origin url` should return a URL that contains no username, password, or token; or users should run the IG Publisher CLI with the `-repo` parameter and specify a URL that contains no username, password, or token."}, {"lang": "es", "value": "El HL7 FHIR IG publisher es una herramienta para tomar un conjunto de entradas y crear un IG de FHIR est\u00e1ndar. Antes de la versi\u00f3n 1.8.9, en contextos de CI, la CLI del editor IG usa comandos git para determinar la URL del repositorio de origen. Si el repositorio se clon\u00f3 o se configur\u00f3 de otra manera para usar un repositorio que usa una URL basada en nombre de usuario y credenciales, la URL completa se incluir\u00e1 en la Gu\u00eda de implementaci\u00f3n creado, exponiendo el nombre de usuario y las credenciales. Esto no afecta a los usuarios que clonan repositorios p\u00fablicos sin credenciales, como aquellos que usan la infraestructura de integraci\u00f3n continua auto-ig-build. Este problema se ha corregido en la versi\u00f3n 1.8.9. Algunos workarounds est\u00e1n disponibles. Los usuarios deben asegurarse de que el repositorio IG que est\u00e1n publicando no tenga nombre de usuario o credenciales incluidos en la URL `origin`. Ejecutar el comando `git remote origin url` deber\u00eda devolver una URL que no contenga nombre de usuario, contrase\u00f1a o token; o los usuarios deben ejecutar la CLI de IG Publisher con el par\u00e1metro `-repo` y especificar una URL que no contenga nombre de usuario, contrase\u00f1a o token."}], "id": "CVE-2025-24363", "lastModified": "2026-06-17T08:58:54.357", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.6, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-24363", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-01-24T19:19:09.087937Z", "version": "2.0.3"}}]}, "published": "2025-01-24T19:15:13.633", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/HL7/fhir-ig-publisher/commit/d968694b7dd041640efab5414d7077d5028569f7"}, {"source": "security-advisories@github.com", "url": "https://github.com/HL7/fhir-ig-publisher/releases/tag/1.8.9"}, {"source": "security-advisories@github.com", "url": "https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-6729-95v3-pjc2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-07-13T11:07:12.374842+00:00", "updated": "2025-07-13T11:07:12.374895+00:00", "vendors": ["hl7", "hl7$PRODUCT$fhir_ig_publisher"]}