{"action":"Upgrade oxidized-web to 0.15.0 or later.","affected":[{"fixed":"0.15.0","introduced":"0"}],"component":"oxidized-web","cve_ids":["CVE-2025-27590"],"ecosystem":"RubyGems","epss":0.27573,"exploited":false,"fixed_versions":["0.15.0"],"ghsa_id":"GHSA-jx6p-9c26-g373","id":"tcs_01M5KEM2CSF5B6DH1F1PXN2X3K","modified_at":"2025-03-03T20:42:06.222305Z","published_at":"2025-03-03T06:30:34Z","references":["https://osv.dev/vulnerability/GHSA-jx6p-9c26-g373","https://nvd.nist.gov/vuln/detail/CVE-2025-27590","https://github.com/ytti/oxidized-web/commit/a5220a0ddc57b85cd122bffee228d3ed4901668e","https://github.com/ytti/oxidized-web","https://github.com/ytti/oxidized-web/releases/tag/0.15.0"],"severity":{"label":"critical","score":9},"sources":[{"source":"osv","source_id":"GHSA-jx6p-9c26-g373","url":"https://osv.dev/vulnerability/GHSA-jx6p-9c26-g373"}],"summary":"Oxidized Web RANCID migration page allows unauthenticated user to gain control over Linux user account"}