CVE-2025-10281 - Vulnerability Details - OpenCVE

BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

References

Link	Providers
https://blog.blacklanternsecurity.com/p/bbot-security-advisory-gitdumper

History

Thu, 09 Oct 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 09 Oct 2025 16:00:00 +0000

Type	Values Removed	Values Added
Description		BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL.
Title		Insecure URL Handling in git_clone Leading to Leaked API Key
Weaknesses		CWE-200
References		https://blog.blacklanternsecurity.com/p/bbot-security-advisory-gitdumper
Metrics		cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: BLSOPS

Published: 2025-10-09T15:45:56.325Z

Updated: 2025-10-09T19:04:36.247Z

Reserved: 2025-09-11T16:19:02.209Z

Link: CVE-2025-10281

Vulnrichment

Updated: 2025-10-09T19:04:30.934Z

NVD

Status : Received

Published: 2025-10-09T16:15:42.807

Modified: 2025-10-09T16:15:42.807

Link: CVE-2025-10281

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-10281", "assignerOrgId": "27b6da8a-f51d-48d9-9eef-9b7f3405d20d", "state": "PUBLISHED", "assignerShortName": "BLSOPS", "dateReserved": "2025-09-11T16:19:02.209Z", "datePublished": "2025-10-09T15:45:56.325Z", "dateUpdated": "2025-10-09T19:04:36.247Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://pypi.org/project/bbot/", "defaultStatus": "unaffected", "packageName": "bbot", "platforms": ["Linux"], "product": "bbot", "repo": "https://github.com/blacklanternsecurity/bbot", "vendor": "BLSOPS, LLC", "versions": [{"lessThanOrEqual": "2.6.1", "status": "affected", "version": "0.0.0", "versionType": "2.7.1"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL."}], "value": "BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL."}], "impacts": [{"capecId": "CAPEC-94", "descriptions": [{"lang": "en", "value": "CAPEC-94 Man in the Middle Attack"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "27b6da8a-f51d-48d9-9eef-9b7f3405d20d", "shortName": "BLSOPS", "dateUpdated": "2025-10-09T15:54:55.350Z"}, "references": [{"url": "https://blog.blacklanternsecurity.com/p/bbot-security-advisory-gitdumper"}], "source": {"discovery": "UNKNOWN"}, "title": "Insecure URL Handling in git_clone Leading to Leaked API Key", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-09T19:04:25.334821Z", "id": "CVE-2025-10281", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-09T19:04:36.247Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10281", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-09T19:04:25.334821Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-09T19:04:30.934Z"}}], "cna": {"title": "Insecure URL Handling in git_clone Leading to Leaked API Key", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-94", "descriptions": [{"lang": "en", "value": "CAPEC-94 Man in the Middle Attack"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/blacklanternsecurity/bbot", "vendor": "BLSOPS, LLC", "product": "bbot", "versions": [{"status": "affected", "version": "0.0.0", "versionType": "2.7.1", "lessThanOrEqual": "2.6.1"}], "platforms": ["Linux"], "packageName": "bbot", "collectionURL": "https://pypi.org/project/bbot/", "defaultStatus": "unaffected"}], "references": [{"url": "https://blog.blacklanternsecurity.com/p/bbot-security-advisory-gitdumper"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL.", "supportingMedia": [{"type": "text/html", "value": "BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "27b6da8a-f51d-48d9-9eef-9b7f3405d20d", "shortName": "BLSOPS", "dateUpdated": "2025-10-09T15:54:55.350Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10281", "state": "PUBLISHED", "dateUpdated": "2025-10-09T19:04:36.247Z", "dateReserved": "2025-09-11T16:19:02.209Z", "assignerOrgId": "27b6da8a-f51d-48d9-9eef-9b7f3405d20d", "datePublished": "2025-10-09T15:45:56.325Z", "assignerShortName": "BLSOPS"}, "dataVersion": "5.1"}