« Volver al listado

CVE-2025-49825

Estado: AplazadaCrítica (9.8)—

Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS AV:N/AC:L/PR:N/UI:N indica explotación remota sin privilegios (T1190). CWE-863 (autorización incorrecta) permite bypass de autenticación remota, otorgando acceso con credenciales válidas (T1078) y potencial escalada de privilegios (T1068).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser TrainingUser Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Alfresco — Community EditionAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-49825",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-49825",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-18T13:40:02.827853Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "gravitational",
          "product": "teleport",
          "versions": [
            {
              "status": "affected",
              "version": "<= 17.5.1"
            },
            {
              "status": "affected",
              "version": "<= 0.0.0-20250616162021-79b2f26125a1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-06-17T22:15:49.917",
  "references": [
    {
      "url": "https://github.com/gravitational/teleport/security/advisories/GHSA-8cqv-pj7f-pwpc",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch."
    },
    {
      "lang": "es",
      "value": "Teleport proporciona conectividad, autenticación, controles de acceso y auditoría para la infraestructura. Las versiones de Community Edition anteriores a la 17.5.1 (incluida) son vulnerables a la omisión de la autenticación remota. Al momento de la publicación, no hay un parche de código abierto disponible."
    }
  ],
  "lastModified": "2026-06-17T09:31:57.647",
  "sourceIdentifier": "security-advisories@github.com"
}