CVE-2025-61679

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-61679", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-09-29T20:25:16.181Z", "datePublished": "2025-10-03T21:27:35.612Z", "dateUpdated": "2025-10-06T15:42:51.744Z"}, "containers": {"cna": {"title": "Anyquery Unauthenticated Access Vulnerability Exposes Private Integration Data", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/julien040/anyquery/security/advisories/GHSA-5f7p-rhmq-hvc7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/julien040/anyquery/security/advisories/GHSA-5f7p-rhmq-hvc7"}, {"name": "https://github.com/julien040/anyquery/commit/43cd8bd3354b9725b245a2354b08e1c9be1cc1d3", "tags": ["x_refsource_MISC"], "url": "https://github.com/julien040/anyquery/commit/43cd8bd3354b9725b245a2354b08e1c9be1cc1d3"}, {"name": "https://github.com/julien040/anyquery/releases/tag/0.4.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/julien040/anyquery/releases/tag/0.4.4"}], "affected": [{"vendor": "julien040", "product": "anyquery", "versions": [{"version": "< 0.4.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-03T21:27:35.612Z"}, "descriptions": [{"lang": "en", "value": "Anyquery is an SQL query engine built on top of SQLite. Versions 0.4.3 and below allow attackers who have already gained access to localhost, even with low privileges, to use the http server through the port unauthenticated, and access private integration data like emails, without any warning of a foreign login from the provider. This issue is fixed in version 0.4.4."}], "source": {"advisory": "GHSA-5f7p-rhmq-hvc7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-06T15:42:42.855114Z", "id": "CVE-2025-61679", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-06T15:42:51.744Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-61679", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-06T15:42:42.855114Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-06T15:42:47.545Z"}}], "cna": {"title": "Anyquery Unauthenticated Access Vulnerability Exposes Private Integration Data", "source": {"advisory": "GHSA-5f7p-rhmq-hvc7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "julien040", "product": "anyquery", "versions": [{"status": "affected", "version": "< 0.4.4"}]}], "references": [{"url": "https://github.com/julien040/anyquery/security/advisories/GHSA-5f7p-rhmq-hvc7", "name": "https://github.com/julien040/anyquery/security/advisories/GHSA-5f7p-rhmq-hvc7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/julien040/anyquery/commit/43cd8bd3354b9725b245a2354b08e1c9be1cc1d3", "name": "https://github.com/julien040/anyquery/commit/43cd8bd3354b9725b245a2354b08e1c9be1cc1d3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/julien040/anyquery/releases/tag/0.4.4", "name": "https://github.com/julien040/anyquery/releases/tag/0.4.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Anyquery is an SQL query engine built on top of SQLite. Versions 0.4.3 and below allow attackers who have already gained access to localhost, even with low privileges, to use the http server through the port unauthenticated, and access private integration data like emails, without any warning of a foreign login from the provider. This issue is fixed in version 0.4.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-03T21:27:35.612Z"}}}, "cveMetadata": {"cveId": "CVE-2025-61679", "state": "PUBLISHED", "dateUpdated": "2025-10-06T15:42:51.744Z", "dateReserved": "2025-09-29T20:25:16.181Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-03T21:27:35.612Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "anyquery", "vendor": "julien040", "versions": [{"status": "affected", "version": "< 0.4.4"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Anyquery is an SQL query engine built on top of SQLite. Versions 0.4.3 and below allow attackers who have already gained access to localhost, even with low privileges, to use the http server through the port unauthenticated, and access private integration data like emails, without any warning of a foreign login from the provider. This issue is fixed in version 0.4.4."}, {"lang": "es", "value": "Anyquery es un motor de consultas SQL construido sobre SQLite. Las versiones 0.4.3 e inferiores permiten a los atacantes que ya han obtenido acceso a localhost, incluso con privilegios bajos, usar el servidor HTTP a trav\u00e9s del puerto sin autenticaci\u00f3n, y acceder a datos privados de integraci\u00f3n como correos electr\u00f3nicos, sin ninguna advertencia de inicio de sesi\u00f3n externo por parte del proveedor. Este problema est\u00e1 solucionado en la versi\u00f3n 0.4.4."}], "id": "CVE-2025-61679", "lastModified": "2026-10-08T22:10:00.563", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61679", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-06T15:42:42.855114Z", "version": "2.0.3"}}]}, "published": "2025-10-03T22:15:32.553", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/julien040/anyquery/commit/43cd8bd3354b9725b245a2354b08e1c9be1cc1d3"}, {"source": "security-advisories@github.com", "url": "https://github.com/julien040/anyquery/releases/tag/0.4.4"}, {"source": "security-advisories@github.com", "url": "https://github.com/julien040/anyquery/security/advisories/GHSA-5f7p-rhmq-hvc7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-10-06T14:42:19.958935+00:00", "updated": "2025-10-06T14:42:19.958985+00:00", "vendors": ["anyquery", "anyquery$PRODUCT$anyquery"]}