CVE-2025-58437

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-58437", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-09-01T20:03:06.532Z", "datePublished": "2025-09-06T02:30:08.378Z", "dateUpdated": "2025-09-08T16:45:15.915Z"}, "containers": {"cna": {"title": "Coder's privilege escalation vulnerability could lead to a cross workspace compromise", "problemTypes": [{"descriptions": [{"cweId": "CWE-613", "lang": "en", "description": "CWE-613: Insufficient Session Expiration", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-279", "lang": "en", "description": "CWE-279: Incorrect Execution-Assigned Permissions", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-277", "lang": "en", "description": "CWE-277: Insecure Inherited Permissions", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/coder/coder/security/advisories/GHSA-j6xf-jwrj-v5qp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/coder/coder/security/advisories/GHSA-j6xf-jwrj-v5qp"}, {"name": "https://github.com/coder/coder/pull/19667", "tags": ["x_refsource_MISC"], "url": "https://github.com/coder/coder/pull/19667"}, {"name": "https://github.com/coder/coder/pull/19668", "tags": ["x_refsource_MISC"], "url": "https://github.com/coder/coder/pull/19668"}, {"name": "https://github.com/coder/coder/pull/19669", "tags": ["x_refsource_MISC"], "url": "https://github.com/coder/coder/pull/19669"}, {"name": "https://github.com/coder/coder/commit/06cbb2890f453cd522bb2158a6549afa3419c276", "tags": ["x_refsource_MISC"], "url": "https://github.com/coder/coder/commit/06cbb2890f453cd522bb2158a6549afa3419c276"}, {"name": "https://github.com/coder/coder/commit/20d67d7d7191a4fd5d36a61c6fc1e23ab59befc0", "tags": ["x_refsource_MISC"], "url": "https://github.com/coder/coder/commit/20d67d7d7191a4fd5d36a61c6fc1e23ab59befc0"}, {"name": "https://github.com/coder/coder/commit/ec660907faa0b0eae20fa2ba58ce1733f5f4b35a", "tags": ["x_refsource_MISC"], "url": "https://github.com/coder/coder/commit/ec660907faa0b0eae20fa2ba58ce1733f5f4b35a"}], "affected": [{"vendor": "coder", "product": "coder", "versions": [{"version": ">= 2.22.0, < 2.24.4", "status": "affected"}, {"version": ">= 2.25.0, < 2.25.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-06T02:30:08.378Z"}, "descriptions": [{"lang": "en", "value": "Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, Coder can be compromised through insecure session handling in prebuilt workspaces. Coder automatically generates a session token for a user when a workspace is started. It is automatically exposed via coder_workspace_owner.session_token. Prebuilt workspaces are initially owned by a built-in prebuilds system user. When a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the prebuilds user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted. This is fixed in versions 2.24.4 and 2.25.2."}], "source": {"advisory": "GHSA-j6xf-jwrj-v5qp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-08T16:45:07.417468Z", "id": "CVE-2025-58437", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-08T16:45:15.915Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-58437", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-08T16:45:07.417468Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-08T16:45:12.066Z"}}], "cna": {"title": "Coder's privilege escalation vulnerability could lead to a cross workspace compromise", "source": {"advisory": "GHSA-j6xf-jwrj-v5qp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": ">= 2.22.0, < 2.24.4"}, {"status": "affected", "version": ">= 2.25.0, < 2.25.2"}]}], "references": [{"url": "https://github.com/coder/coder/security/advisories/GHSA-j6xf-jwrj-v5qp", "name": "https://github.com/coder/coder/security/advisories/GHSA-j6xf-jwrj-v5qp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/coder/coder/pull/19667", "name": "https://github.com/coder/coder/pull/19667", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/coder/coder/pull/19668", "name": "https://github.com/coder/coder/pull/19668", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/coder/coder/pull/19669", "name": "https://github.com/coder/coder/pull/19669", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/coder/coder/commit/06cbb2890f453cd522bb2158a6549afa3419c276", "name": "https://github.com/coder/coder/commit/06cbb2890f453cd522bb2158a6549afa3419c276", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/coder/coder/commit/20d67d7d7191a4fd5d36a61c6fc1e23ab59befc0", "name": "https://github.com/coder/coder/commit/20d67d7d7191a4fd5d36a61c6fc1e23ab59befc0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/coder/coder/commit/ec660907faa0b0eae20fa2ba58ce1733f5f4b35a", "name": "https://github.com/coder/coder/commit/ec660907faa0b0eae20fa2ba58ce1733f5f4b35a", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, Coder can be compromised through insecure session handling in prebuilt workspaces. Coder automatically generates a session token for a user when a workspace is started. It is automatically exposed via coder_workspace_owner.session_token. Prebuilt workspaces are initially owned by a built-in prebuilds system user. When a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the prebuilds user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted. This is fixed in versions 2.24.4 and 2.25.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-613", "description": "CWE-613: Insufficient Session Expiration"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-279", "description": "CWE-279: Incorrect Execution-Assigned Permissions"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-277", "description": "CWE-277: Insecure Inherited Permissions"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-06T02:30:08.378Z"}}}, "cveMetadata": {"cveId": "CVE-2025-58437", "state": "PUBLISHED", "dateUpdated": "2025-09-08T16:45:15.915Z", "dateReserved": "2025-09-01T20:03:06.532Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-09-06T02:30:08.378Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "coder", "vendor": "coder", "versions": [{"status": "affected", "version": ">= 2.22.0, < 2.24.4"}, {"status": "affected", "version": ">= 2.25.0, < 2.25.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:*", "matchCriteriaId": "A8F90474-94D7-4818-9484-420FB0730C13", "versionEndExcluding": "2.24.4", "versionStartIncluding": "2.22", "vulnerable": true}, {"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:*", "matchCriteriaId": "99234FDA-3823-4D78-BE28-7A9F54A58481", "versionEndExcluding": "2.25.2", "versionStartIncluding": "2.25.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, Coder can be compromised through insecure session handling in prebuilt workspaces. Coder automatically generates a session token for a user when a workspace is started. It is automatically exposed via coder_workspace_owner.session_token. Prebuilt workspaces are initially owned by a built-in prebuilds system user. When a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the prebuilds user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted. This is fixed in versions 2.24.4 and 2.25.2."}, {"lang": "es", "value": "Coder permite a las organizaciones aprovisionar entornos de desarrollo remotos a trav\u00e9s de Terraform. En las versiones 2.22.0 a 2.24.3, 2.25.0 y 2.25.1, Coder puede verse comprometido debido a un manejo inseguro de la sesi\u00f3n en espacios de trabajo preconstruidos. Coder genera autom\u00e1ticamente un token de sesi\u00f3n para un usuario cuando se inicia un espacio de trabajo. Se expone autom\u00e1ticamente a trav\u00e9s de coder_workspace_owner.session_token. Los espacios de trabajo preconstruidos son inicialmente propiedad de un usuario del sistema de preconstrucciones integrado. Cuando se reclama un espacio de trabajo preconstruido, se genera un nuevo token de sesi\u00f3n para el usuario que reclam\u00f3 el espacio de trabajo, pero el token de sesi\u00f3n anterior para el usuario de preconstrucciones no caduc\u00f3. Cualquier plantilla de espacio de trabajo de Coder que persista este token de sesi\u00f3n generado autom\u00e1ticamente puede verse potencialmente afectada. Esto se solucion\u00f3 en las versiones 2.24.4 y 2.25.2."}], "id": "CVE-2025-58437", "lastModified": "2026-10-19T17:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58437", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-08T16:45:07.417468Z", "version": "2.0.3"}}]}, "published": "2025-09-06T03:15:40.287", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/coder/coder/commit/06cbb2890f453cd522bb2158a6549afa3419c276"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/coder/coder/commit/20d67d7d7191a4fd5d36a61c6fc1e23ab59befc0"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/coder/coder/commit/ec660907faa0b0eae20fa2ba58ce1733f5f4b35a"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/coder/coder/pull/19667"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/coder/coder/pull/19668"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/coder/coder/pull/19669"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/coder/coder/security/advisories/GHSA-j6xf-jwrj-v5qp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-277"}, {"lang": "en", "value": "CWE-279"}, {"lang": "en", "value": "CWE-613"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-613"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}