Refine your search
2 vulnerabilities found for minder by mindersec
CVE-2025-65109 (GCVE-0-2025-65109)
Vulnerability from nvd
Published
2025-11-21 21:56
Modified
2025-11-24 17:17
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-830 - Inclusion of Web Functionality from an Untrusted Source
Summary
Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to. This issue has been patched in Minder Helm version 0.20250203.3849+ref.fdc94f0 and Minder Go version 0.0.84.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-65109",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-24T17:17:34.507772Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-24T17:17:41.932Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "minder",
"vendor": "mindersec",
"versions": [
{
"status": "affected",
"version": "Helm = 0.20241106.3386+ref.2507dbf"
},
{
"status": "affected",
"version": "Go \u003e= 0.0.72, \u003c 0.0.84"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to. This issue has been patched in Minder Helm version 0.20250203.3849+ref.fdc94f0 and Minder Go version 0.0.84."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-830",
"description": "CWE-830: Inclusion of Web Functionality from an Untrusted Source",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-21T21:56:53.667Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mindersec/minder/security/advisories/GHSA-6xvf-4vh9-mw47",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mindersec/minder/security/advisories/GHSA-6xvf-4vh9-mw47"
},
{
"name": "https://github.com/mindersec/minder/commit/f770400923984649a287d7215410ef108e845af8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mindersec/minder/commit/f770400923984649a287d7215410ef108e845af8"
}
],
"source": {
"advisory": "GHSA-6xvf-4vh9-mw47",
"discovery": "UNKNOWN"
},
"title": "Minder does not sandbox http.send in Rego programs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-65109",
"datePublished": "2025-11-21T21:56:53.667Z",
"dateReserved": "2025-11-17T20:55:34.694Z",
"dateUpdated": "2025-11-24T17:17:41.932Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-65109 (GCVE-0-2025-65109)
Vulnerability from cvelistv5
Published
2025-11-21 21:56
Modified
2025-11-24 17:17
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-830 - Inclusion of Web Functionality from an Untrusted Source
Summary
Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to. This issue has been patched in Minder Helm version 0.20250203.3849+ref.fdc94f0 and Minder Go version 0.0.84.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-65109",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-24T17:17:34.507772Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-24T17:17:41.932Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "minder",
"vendor": "mindersec",
"versions": [
{
"status": "affected",
"version": "Helm = 0.20241106.3386+ref.2507dbf"
},
{
"status": "affected",
"version": "Go \u003e= 0.0.72, \u003c 0.0.84"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to. This issue has been patched in Minder Helm version 0.20250203.3849+ref.fdc94f0 and Minder Go version 0.0.84."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-830",
"description": "CWE-830: Inclusion of Web Functionality from an Untrusted Source",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-21T21:56:53.667Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mindersec/minder/security/advisories/GHSA-6xvf-4vh9-mw47",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mindersec/minder/security/advisories/GHSA-6xvf-4vh9-mw47"
},
{
"name": "https://github.com/mindersec/minder/commit/f770400923984649a287d7215410ef108e845af8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mindersec/minder/commit/f770400923984649a287d7215410ef108e845af8"
}
],
"source": {
"advisory": "GHSA-6xvf-4vh9-mw47",
"discovery": "UNKNOWN"
},
"title": "Minder does not sandbox http.send in Rego programs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-65109",
"datePublished": "2025-11-21T21:56:53.667Z",
"dateReserved": "2025-11-17T20:55:34.694Z",
"dateUpdated": "2025-11-24T17:17:41.932Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}