CVE-2025-1390
published 2025-02-18CVE-2025-1390: The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are…
PriorityP429medium6.1CVSS 3.1
AVLACLPRLUINSUCLIHAN
EPSS
0.16%
5.2th percentile
The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.
Affected
95 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libcap2 | < libcap2 1:2.66-4+deb12u1 (bookworm) | libcap2 1:2.66-4+deb12u1 (bookworm) |
| fortinet | fortinet | — | — |
| fortinet | fortipam | — | — |
| fortinet | fortiswitchmanager | — | — |
| github.com | hashicorp-forge_hermes | >= 0 < 0.5.0 | 0.5.0 |
| gitlab | gitlab | — | — |
| gitlab | gitlab_ce | — | — |
| microsoft | microsoft.aspnetcore.app.runtime.linux-arm | 6.0.0 – 6.0.36 | — |
| microsoft | microsoft.aspnetcore.app.runtime.linux-arm | >= 8.0.0 < 8.0.14 | 8.0.14 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-arm | >= 9.0.0 < 9.0.3 | 9.0.3 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-arm64 | 6.0.0 – 6.0.36 | — |
| microsoft | microsoft.aspnetcore.app.runtime.linux-arm64 | >= 8.0.0 < 8.0.14 | 8.0.14 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-arm64 | >= 9.0.0 < 9.0.3 | 9.0.3 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-arm | 6.0.0 – 6.0.36 | — |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-arm | >= 8.0.0 < 8.0.14 | 8.0.14 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-arm | >= 9.0.0 < 9.0.3 | 9.0.3 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-arm64 | 6.0.0 – 6.0.36 | — |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-arm64 | >= 8.0.0 < 8.0.14 | 8.0.14 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-arm64 | >= 9.0.0 < 9.0.3 | 9.0.3 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-x64 | 6.0.0 – 6.0.36 | — |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-x64 | >= 8.0.0 < 8.0.14 | 8.0.14 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-x64 | >= 9.0.0 < 9.0.3 | 9.0.3 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-x64 | 6.0.0 – 6.0.36 | — |
| microsoft | microsoft.aspnetcore.app.runtime.linux-x64 | >= 8.0.0 < 8.0.14 | 8.0.14 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-x64 | >= 9.0.0 < 9.0.3 | 9.0.3 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
ghsa8.2HIGH
osv6.1MEDIUM
vendor_msrc8.8HIGH
vendor_debian6.1MEDIUM
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
rollbar vulnerable to Prototype Pollution in merge()
ghsa·2025-10-23
CVE-2025-62517 [MEDIUM] CWE-1321 rollbar vulnerable to Prototype Pollution in merge()
rollbar vulnerable to Prototype Pollution in merge()
### Impact
Prototype pollution vulnerability in merge(). If application code calls `rollbar.configure()` with untrusted input, prototype pollution is possible.
### Patches
Fixed in 2.26.5 and 3.0.0-beta5.
### Workarounds
Ensure that values passed to `rollbar.configure()` do not contain untrusted input.
### References
Fixed in https://github.com/rollbar/rollbar.js/pull/1394 (2.26.x) and https://github.com/rollbar/rollbar.js/pull/1390 (3.x)
GHSA
Jenkins WSO2 Oauth Plugin Fails to Properly Authenticate User Credentials
ghsa·2025-05-14
CVE-2025-47889 [HIGH] CWE-1390 Jenkins WSO2 Oauth Plugin Fails to Properly Authenticate User Credentials
Jenkins WSO2 Oauth Plugin Fails to Properly Authenticate User Credentials
In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticated attackers to log in to controllers using this security realm using any username and any password, including usernames that do not exist.
GHSA
Microsoft Security Advisory CVE-2025-24070: .NET Elevation of Privilege Vulnerability
ghsa·2025-03-11·CVSS 7.0
CVE-2025-24070 [HIGH] CWE-1390 Microsoft Security Advisory CVE-2025-24070: .NET Elevation of Privilege Vulnerability
Microsoft Security Advisory CVE-2025-24070: .NET Elevation of Privilege Vulnerability
# Microsoft Security Advisory CVE-2025-24070: .NET Elevation of Privilege Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 9.0, ASP.NET Core 8.0, ASP.NET Core 6.0, and ASP.NET Core 2.3. This advisory also provides guidance on what developers can do to update their applications to address this vulnerability.
A vulnerability exists in ASP.NET Core applications calling RefreshSignInAsync with an improperly authenticated user parameter that could allow an attacker to sign into another user's account, resulting in Elevation of Privilege.
## Announcement
Announcement for this issue can be found at https://github.c
GHSA
Hermes improperly validates a JWT
ghsa·2025-02-20·CVSS 8.2
CVE-2025-1293 [HIGH] CWE-1390 Hermes improperly validates a JWT
Hermes improperly validates a JWT
Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0.
GHSA
GHSA-cq92-4vj3-mcq8: The PAM module pam_cap
ghsa_unreviewed·2025-02-18
CVE-2025-1390 [MEDIUM] CWE-284 GHSA-cq92-4vj3-mcq8: The PAM module pam_cap
The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.
OSV
CVE-2025-1390: The PAM module pam_cap
osv·2025-02-18·CVSS 6.1
CVE-2025-1390 [MEDIUM] CVE-2025-1390: The PAM module pam_cap
The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.
Fortinet
Weak authentication in WAD/GUI
vendor_fortinet·2025-10-14·CVSS 8.1
CVE-2025-49201 [HIGH] CWE-1390 Weak authentication in WAD/GUI
FG-IR-25-010: Weak authentication in WAD/GUI
A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiSwitchManager 7.2.0 through 7.2.4 allows attacker to execute unauthorized code or commands via specially crafted http requests
CVEs: CVE-2025-49201
CWEs: CWE-1390
CVSS: 8.1 (high)
Affected products: FortiPAM, FortiSwitchManager, FortiSwitchmanager, Fortinet
Microsoft
Microsoft Exchange Server Elevation of Privilege Vulnerability
vendor_msrc·2025-10-14·CVSS 8.8
CVE-2025-59249 [HIGH] CWE-1390 Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
Description: Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
FAQ: What privileges could be gained by an attacker who successfully exploited the vulnerability?
The attacker would be able to take over the mailboxes of all Exchange users, attackers can send emails, read emails, download attachments.
FAQ: How could an attacker exploit this vulnerability?
An attacker would first have to compromise with a user account who is member of an admin group to run the required code.
Microsoft Exchange Server: Microsoft Exchange Server
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Elevation of Privilege
Exploit Status: Publicly Disclosed:No;Exploited:No;
Microsoft
Azure Machine Learning Elevation of Privilege Vulnerability
vendor_msrc·2025-07-08·CVSS 6.5
CVE-2025-47995 [MEDIUM] CWE-1390 Azure Machine Learning Elevation of Privilege Vulnerability
Azure Machine Learning Elevation of Privilege Vulnerability
Description: Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.
FAQ: Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
Azure Machine Learning: Azure Machine Learning
Microsoft: Microsoft
Customer Action Required: No
Impact: Elevation of Privilege
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A
GitLab
CVE-2025-0605: An issue has been discovered in GitLab CE/EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Group acce
vendor_gitlab·2025-05-22·CVSS 4.6
CVE-2025-0605 [MEDIUM] CWE-1390 CVE-2025-0605: An issue has been discovered in GitLab CE/EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Group acce
CVE-2025-0605: An issue has been discovered in GitLab CE/EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Group access controls could allow certain users to bypass two-factor authentication requirements.
Microsoft
Active Directory Certificate Services Elevation of Privilege Vulnerability
vendor_msrc·2025-04-08·CVSS 8.8
CVE-2025-27740 [HIGH] CWE-1390 Active Directory Certificate Services Elevation of Privilege Vulnerability
Active Directory Certificate Services Elevation of Privilege Vulnerability
Description: Weak authentication in Windows Active Directory Certificate Services allows an authorized attacker to elevate privileges over a network.
FAQ: How could an attacker exploit this vulnerability?
An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow elevation of privilege to those of domain administrator.
Windows Active Directory Certificate Services: Windows Active Directory Certificate Services
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Elevation of Privilege
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely
Ref
Microsoft
Windows Hello Security Feature Bypass Vulnerability
vendor_msrc·2025-04-08·CVSS 6.5
CVE-2025-26635 [MEDIUM] CWE-1390 Windows Hello Security Feature Bypass Vulnerability
Windows Hello Security Feature Bypass Vulnerability
Description: Weak authentication in Windows Hello allows an authorized attacker to bypass a security feature over a network.
FAQ: What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An attacker who successfully exploited this vulnerability could bypass the Windows Hello security feature.
Where can I find more information about Windows Hello?
Please see Windows Hello | Microsoft Learn for more details.
Windows Hello: Windows Hello
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Security Feature Bypass
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5055519
Microsoft
ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
vendor_msrc·2025-03-11·CVSS 7.0
CVE-2025-24070 [HIGH] CWE-1390 ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
Description: Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network.
FAQ: What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker who successfully exploited this vulnerability could gain the privileges of the compromised user.
FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to gather information specific to the environment and take additional actions prior to exploitation to prepare the target environment.
ASP.NET Core & Visual Studio: ASP.NET Core & Visual Studio
Microso
Ubuntu
libcap2 vulnerability
vendor_ubuntu·2025-02-24
CVE-2025-1390 libcap2 vulnerability
Title: libcap2 vulnerability
Summary: libcap2 would allow unintended capabilities.
Tianjia Zhang discovered the libcap2 PAM module pam_cap incorrectly
handled parsing group names in the configuration file. This could result in
certain users being granted capabilities, contrary to expectations.
Instructions: After a standard system update you need to reboot your computer to make all
the necessary changes.
Red Hat
libcap: pam_cap: Fix potential configuration parsing error
vendor_redhat·2025-02-18·CVSS 6.1
CVE-2025-1390 [MEDIUM] CWE-284 libcap: pam_cap: Fix potential configuration parsing error
libcap: pam_cap: Fix potential configuration parsing error
The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.
A flaw was found in libcap. This vulnerability allows local privilege escalation via incorrect parsing of group names in /etc/security/capability.conf, leading to unintended users being granted inherited capabilities.
Microsoft
pam_cap: Fix potential configuration parsing error
vendor_msrc·2025-02-11·CVSS 6.1
CVE-2025-1390 [MEDIUM] CWE-284 pam_cap: Fix potential configuration parsing error
pam_cap: Fix potential configuration parsing error
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
Anolis: Anolis
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.mi
Debian
CVE-2025-1390: libcap2 - The PAM module pam_cap.so of libcap configuration supports group names starting ...
vendor_debian·2025·CVSS 6.1
CVE-2025-1390 [MEDIUM] CVE-2025-1390: libcap2 - The PAM module pam_cap.so of libcap configuration supports group names starting ...
The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.
Scope: local
bookworm: resolved (fixed in 1:2.66-4+deb12u1)
bullseye: resolved (fixed in 1:2.44-1+deb11u1)
forky: resolved (fixed in 1:2.73-4)
sid: resolved (fixed in 1:2.73-4)
trixie: resolved (fixed in 1:2.73-4)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-02-18
Published