CVSS: 8.7EPSS: 0%CPEs: 1EXPL: 0CVE-2025-23012 – Fedora Repository fedoraIntCallUser default credentials
https://notcve.org/view.php?id=CVE-2025-23012
23 Jan 2025 — Fedora Repository 3.8.x includes a service account (fedoraIntCallUser) with default credentials and privileges to read read local files by manipulating datastreams. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported version (6.5.1 as of 2025-01-23). • https://github.com/fcrepo-exts/migration-utils • CWE-1392: Use of Default Credentials •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2025-23011 – Fedora Repository archive extraction path traversal
https://notcve.org/view.php?id=CVE-2025-23011
23 Jan 2025 — Fedora Repository 3.8.1 allows path traversal when extracting uploaded archives ("Zip Slip"). A remote, authenticated attacker can upload a specially crafted archive that will extract an arbitrary JSP file to a location that can be executed by an unauthenticated GET request. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported version (6.5.1 as of 2025-01-23). • https://github.com/fcrepo-exts/migration-utils • CWE-23: Relative Path Traversal •