CVE-2025-58067

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-58067", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-08-22T14:30:32.222Z", "datePublished": "2025-08-29T21:05:22.209Z", "dateUpdated": "2025-09-02T13:52:49.721Z"}, "containers": {"cna": {"title": "Basecamp's Google Sign-In for Rails allowed redirects to protocol-relative URI", "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/basecamp/google_sign_in/security/advisories/GHSA-5jch-xhw4-r43v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/basecamp/google_sign_in/security/advisories/GHSA-5jch-xhw4-r43v"}, {"name": "https://github.com/basecamp/google_sign_in/pull/75", "tags": ["x_refsource_MISC"], "url": "https://github.com/basecamp/google_sign_in/pull/75"}, {"name": "https://github.com/basecamp/google_sign_in/commit/e97aef4626b1bcbd2c6f01f7dd25f12ac855d4cc", "tags": ["x_refsource_MISC"], "url": "https://github.com/basecamp/google_sign_in/commit/e97aef4626b1bcbd2c6f01f7dd25f12ac855d4cc"}, {"name": "https://github.com/basecamp/google_sign_in/releases/tag/v1.3.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/basecamp/google_sign_in/releases/tag/v1.3.1"}], "affected": [{"vendor": "basecamp", "product": "google_sign_in", "versions": [{"version": "< 1.3.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-08-29T21:05:22.209Z"}, "descriptions": [{"lang": "en", "value": "Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.1, it is possible to redirect a user to another origin if the \"proceed_to\" value in the session store is set to a protocol-relative URL. Normally the value of this URL is only written and read by the library or the calling application. However, it may be possible to set this session value from a malicious site with a form submission. Any Rails applications using the google_sign_in gem may be vulnerable, if this vector can be chained with another attack that is able to modify the OAuth2 request parameters. This issue has been patched in version 1.3.1. There are no workarounds."}], "source": {"advisory": "GHSA-5jch-xhw4-r43v", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-02T13:52:36.468526Z", "id": "CVE-2025-58067", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-02T13:52:49.721Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-58067", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-02T13:52:36.468526Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-02T13:52:46.148Z"}}], "cna": {"title": "Basecamp's Google Sign-In for Rails allowed redirects to protocol-relative URI", "source": {"advisory": "GHSA-5jch-xhw4-r43v", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "basecamp", "product": "google_sign_in", "versions": [{"status": "affected", "version": "< 1.3.1"}]}], "references": [{"url": "https://github.com/basecamp/google_sign_in/security/advisories/GHSA-5jch-xhw4-r43v", "name": "https://github.com/basecamp/google_sign_in/security/advisories/GHSA-5jch-xhw4-r43v", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/basecamp/google_sign_in/pull/75", "name": "https://github.com/basecamp/google_sign_in/pull/75", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/basecamp/google_sign_in/commit/e97aef4626b1bcbd2c6f01f7dd25f12ac855d4cc", "name": "https://github.com/basecamp/google_sign_in/commit/e97aef4626b1bcbd2c6f01f7dd25f12ac855d4cc", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/basecamp/google_sign_in/releases/tag/v1.3.1", "name": "https://github.com/basecamp/google_sign_in/releases/tag/v1.3.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.1, it is possible to redirect a user to another origin if the \"proceed_to\" value in the session store is set to a protocol-relative URL. Normally the value of this URL is only written and read by the library or the calling application. However, it may be possible to set this session value from a malicious site with a form submission. Any Rails applications using the google_sign_in gem may be vulnerable, if this vector can be chained with another attack that is able to modify the OAuth2 request parameters. This issue has been patched in version 1.3.1. There are no workarounds."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-08-29T21:05:22.209Z"}}}, "cveMetadata": {"cveId": "CVE-2025-58067", "state": "PUBLISHED", "dateUpdated": "2025-09-02T13:52:49.721Z", "dateReserved": "2025-08-22T14:30:32.222Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-08-29T21:05:22.209Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "google_sign_in", "vendor": "basecamp", "versions": [{"status": "affected", "version": "< 1.3.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.1, it is possible to redirect a user to another origin if the \"proceed_to\" value in the session store is set to a protocol-relative URL. Normally the value of this URL is only written and read by the library or the calling application. However, it may be possible to set this session value from a malicious site with a form submission. Any Rails applications using the google_sign_in gem may be vulnerable, if this vector can be chained with another attack that is able to modify the OAuth2 request parameters. This issue has been patched in version 1.3.1. There are no workarounds."}, {"lang": "es", "value": "Google Sign-In de Basecamp a\u00f1ade el inicio de sesi\u00f3n de Google a las aplicaciones Rails. Antes de la versi\u00f3n 1.3.1, es posible redirigir a un usuario a otro origen si el valor \u201cproceed_to\u201d en el almac\u00e9n de la sesi\u00f3n se establece como una URL relativa al protocolo. Normalmente, el valor de esta URL solo es escrito y le\u00eddo por la biblioteca o la aplicaci\u00f3n que realiza la llamada. Sin embargo, puede ser posible establecer este valor de la sesi\u00f3n desde un sitio malicioso mediante el env\u00edo de un formulario. Cualquier aplicaci\u00f3n Rails que utilice la gema google_sign_in puede ser vulnerable, si este vector puede encadenarse con otro ataque que sea capaz de modificar los par\u00e1metros de la solicitud OAuth2. Este problema ha sido parcheado en la versi\u00f3n 1.3.1. No hay soluciones alternativas."}], "id": "CVE-2025-58067", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58067", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-02T13:52:36.468526Z", "version": "2.0.3"}}]}, "published": "2025-08-29T21:15:36.480", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/basecamp/google_sign_in/commit/e97aef4626b1bcbd2c6f01f7dd25f12ac855d4cc"}, {"source": "security-advisories@github.com", "url": "https://github.com/basecamp/google_sign_in/pull/75"}, {"source": "security-advisories@github.com", "url": "https://github.com/basecamp/google_sign_in/releases/tag/v1.3.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/basecamp/google_sign_in/security/advisories/GHSA-5jch-xhw4-r43v"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-09-02T15:23:32.376086+00:00", "updated": "2025-09-02T15:23:32.376162+00:00", "vendors": ["basecamp", "basecamp$PRODUCT$basecamp"]}