CVE-2025-62607

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-62607", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-10-16T19:24:37.268Z", "datePublished": "2025-10-22T15:40:46.355Z", "dateUpdated": "2025-10-22T16:05:50.810Z"}, "containers": {"cna": {"title": "Nautobot Single Source of Truth (SSoT) has an unauthenticated ServiceNow configuration URL", "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/nautobot/nautobot-app-ssot/security/advisories/GHSA-535g-62r7-cx6v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nautobot/nautobot-app-ssot/security/advisories/GHSA-535g-62r7-cx6v"}, {"name": "https://github.com/nautobot/nautobot-app-ssot/commit/1530d25cdeb929641ec47644f9a0a1d9d41e1cb8", "tags": ["x_refsource_MISC"], "url": "https://github.com/nautobot/nautobot-app-ssot/commit/1530d25cdeb929641ec47644f9a0a1d9d41e1cb8"}, {"name": "https://github.com/nautobot/nautobot-app-ssot/releases/tag/v3.10.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/nautobot/nautobot-app-ssot/releases/tag/v3.10.0"}], "affected": [{"vendor": "nautobot", "product": "nautobot-app-ssot", "versions": [{"version": "< 3.10.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-22T15:40:46.355Z"}, "descriptions": [{"lang": "en", "value": "Nautobot Single Source of Truth (SSoT) is an app for Nautobot. Prior to version 3.10.0, an unauthenticated attacker could access this page to view the Service Now public instance name e.g. companyname.service-now.com. This is considered low-value information. This does not expose the Secret, the Secret Name, or the Secret Value for the Username/Password for Service-Now.com. An unauthenticated member would not be able to change the instance name, nor set a Secret. There is not a way to gain access to other pages Nautobot through the unauthenticated Configuration page. This issue has been patched in version 3.10.0."}], "source": {"advisory": "GHSA-535g-62r7-cx6v", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-22T16:05:41.837662Z", "id": "CVE-2025-62607", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-22T16:05:50.810Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-62607", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-22T16:05:41.837662Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-22T16:05:46.181Z"}}], "cna": {"title": "Nautobot Single Source of Truth (SSoT) has an unauthenticated ServiceNow configuration URL", "source": {"advisory": "GHSA-535g-62r7-cx6v", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "nautobot", "product": "nautobot-app-ssot", "versions": [{"status": "affected", "version": "< 3.10.0"}]}], "references": [{"url": "https://github.com/nautobot/nautobot-app-ssot/security/advisories/GHSA-535g-62r7-cx6v", "name": "https://github.com/nautobot/nautobot-app-ssot/security/advisories/GHSA-535g-62r7-cx6v", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nautobot/nautobot-app-ssot/commit/1530d25cdeb929641ec47644f9a0a1d9d41e1cb8", "name": "https://github.com/nautobot/nautobot-app-ssot/commit/1530d25cdeb929641ec47644f9a0a1d9d41e1cb8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nautobot/nautobot-app-ssot/releases/tag/v3.10.0", "name": "https://github.com/nautobot/nautobot-app-ssot/releases/tag/v3.10.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Nautobot Single Source of Truth (SSoT) is an app for Nautobot. Prior to version 3.10.0, an unauthenticated attacker could access this page to view the Service Now public instance name e.g. companyname.service-now.com. This is considered low-value information. This does not expose the Secret, the Secret Name, or the Secret Value for the Username/Password for Service-Now.com. An unauthenticated member would not be able to change the instance name, nor set a Secret. There is not a way to gain access to other pages Nautobot through the unauthenticated Configuration page. This issue has been patched in version 3.10.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-22T15:40:46.355Z"}}}, "cveMetadata": {"cveId": "CVE-2025-62607", "state": "PUBLISHED", "dateUpdated": "2025-10-22T16:05:50.810Z", "dateReserved": "2025-10-16T19:24:37.268Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-22T15:40:46.355Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "nautobot-app-ssot", "vendor": "nautobot", "versions": [{"status": "affected", "version": "< 3.10.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nautobot Single Source of Truth (SSoT) is an app for Nautobot. Prior to version 3.10.0, an unauthenticated attacker could access this page to view the Service Now public instance name e.g. companyname.service-now.com. This is considered low-value information. This does not expose the Secret, the Secret Name, or the Secret Value for the Username/Password for Service-Now.com. An unauthenticated member would not be able to change the instance name, nor set a Secret. There is not a way to gain access to other pages Nautobot through the unauthenticated Configuration page. This issue has been patched in version 3.10.0."}, {"lang": "es", "value": "Nautobot Single Source of Truth (SSoT) es una aplicaci\u00f3n para Nautobot. Antes de la versi\u00f3n 3.10.0, un atacante no autenticado pod\u00eda acceder a esta p\u00e1gina para ver el nombre de instancia p\u00fablica de Service Now, por ejemplo, companyname.service-now.com. Esto se considera informaci\u00f3n de bajo valor. Esto no expone el Secreto, el Nombre del Secreto o el Valor del Secreto para el Nombre de Usuario/Contrase\u00f1a de Service-Now.com. Un miembro no autenticado no podr\u00eda cambiar el nombre de la instancia, ni establecer un Secreto. No hay una forma de obtener acceso a otras p\u00e1ginas de Nautobot a trav\u00e9s de la p\u00e1gina de Configuraci\u00f3n no autenticada. Este problema ha sido parcheado en la versi\u00f3n 3.10.0."}], "id": "CVE-2025-62607", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62607", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-22T16:05:41.837662Z", "version": "2.0.3"}}]}, "published": "2025-10-22T16:15:45.493", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/nautobot/nautobot-app-ssot/commit/1530d25cdeb929641ec47644f9a0a1d9d41e1cb8"}, {"source": "security-advisories@github.com", "url": "https://github.com/nautobot/nautobot-app-ssot/releases/tag/v3.10.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/nautobot/nautobot-app-ssot/security/advisories/GHSA-535g-62r7-cx6v"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-10-23T09:59:16.078384+00:00", "updated": "2025-10-23T09:59:16.078410+00:00", "vendors": ["nautobot", "nautobot$PRODUCT$app-ssot"]}