cvelistv5 - cve-2025-23090

CVE-2025-23090 (GCVE-0-2025-23090)

Vulnerability from cvelistv5

This CVE record has been withdrawn due to a duplicate entry CVE-2025-23083.

Replaced by CVE-2025-23083

Show details on NVD website

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2025-07-18T23:02:35.042Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE record has been withdrawn due to a duplicate entry CVE-2025-23083."
        }
      ],
      "replacedBy": [
        "CVE-2025-23083"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2025-23090",
    "datePublished": "2025-01-22T01:11:30.802Z",
    "dateRejected": "2025-07-18T23:02:35.042Z",
    "dateReserved": "2025-01-10T19:05:52.772Z",
    "dateUpdated": "2025-07-18T23:02:35.042Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-23090\",\"sourceIdentifier\":\"support@hackerone.com\",\"published\":\"2025-01-22T02:15:34.443\",\"lastModified\":\"2025-07-18T23:15:22.337\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: This CVE record has been withdrawn due to a duplicate entry CVE-2025-23083.\"}],\"metrics\":{},\"references\":[]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"rejectedReasons\": [{\"value\": \"This CVE record has been withdrawn due to a duplicate entry CVE-2025-23083.\", \"lang\": \"en\"}], \"replacedBy\": [\"CVE-2025-23083\"], \"providerMetadata\": {\"orgId\": \"36234546-b8fa-4601-9d6f-f4e334aa8ea1\", \"shortName\": \"hackerone\", \"dateUpdated\": \"2025-07-18T23:02:35.042Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-23090\", \"assignerOrgId\": \"36234546-b8fa-4601-9d6f-f4e334aa8ea1\", \"state\": \"REJECTED\", \"assignerShortName\": \"hackerone\", \"dateReserved\": \"2025-01-10T19:05:52.772Z\", \"datePublished\": \"2025-01-22T01:11:30.802Z\", \"dateUpdated\": \"2025-07-18T23:02:35.042Z\", \"dateRejected\": \"2025-07-18T23:02:35.042Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

msrc_cve-2025-23090

Vulnerability from csaf_microsoft

Published

2025-01-02 00:00

Modified

2025-09-03 22:50

Summary

Rejected reason: This CVE record has been withdrawn due to a duplicate entry CVE-2025-23083.

Notes

Additional Resources

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer

The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2025-23090 Rejected reason: This CVE record has been withdrawn due to a duplicate entry CVE-2025-23083. - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-23090.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Rejected reason: This CVE record has been withdrawn due to a duplicate entry CVE-2025-23083.",
    "tracking": {
      "current_release_date": "2025-09-03T22:50:35.000Z",
      "generator": {
        "date": "2025-10-20T02:49:00.516Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2025-23090",
      "initial_release_date": "2025-01-02T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-09-03T22:50:35.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 nodejs 20.14.0-4",
                "product": {
                  "name": "\u003cazl3 nodejs 20.14.0-4",
                  "product_id": "2"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 nodejs 20.14.0-4",
                "product": {
                  "name": "azl3 nodejs 20.14.0-4",
                  "product_id": "19353"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 nodejs 20.14.0-8",
                "product": {
                  "name": "\u003cazl3 nodejs 20.14.0-8",
                  "product_id": "1"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 nodejs 20.14.0-8",
                "product": {
                  "name": "azl3 nodejs 20.14.0-8",
                  "product_id": "19608"
                }
              }
            ],
            "category": "product_name",
            "name": "nodejs"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 nodejs 20.14.0-4 as a component of Azure Linux 3.0",
          "product_id": "17084-2"
        },
        "product_reference": "2",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 nodejs 20.14.0-4 as a component of Azure Linux 3.0",
          "product_id": "19353-17084"
        },
        "product_reference": "19353",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 nodejs 20.14.0-8 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 nodejs 20.14.0-8 as a component of Azure Linux 3.0",
          "product_id": "19608-17084"
        },
        "product_reference": "19608",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-23090",
      "notes": [
        {
          "category": "general",
          "text": "hackerone",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "19353-17084",
          "19608-17084"
        ],
        "known_affected": [
          "17084-2",
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-23090 Rejected reason: This CVE record has been withdrawn due to a duplicate entry CVE-2025-23083. - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-23090.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-09-03T22:50:35.000Z",
          "details": "20.14.0-4:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-2"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2025-09-03T22:50:35.000Z",
          "details": "Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-1"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        }
      ],
      "title": "Rejected reason: This CVE record has been withdrawn due to a duplicate entry CVE-2025-23083."
    }
  ]
}

fkie_cve-2025-23090

Vulnerability from fkie_nvd

Published

2025-01-22 02:15

Modified

2025-07-18 23:15

Severity ?

Summary

Rejected reason: This CVE record has been withdrawn due to a duplicate entry CVE-2025-23083.

References

	URL	Tags

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rejected reason: This CVE record has been withdrawn due to a duplicate entry CVE-2025-23083."
    }
  ],
  "id": "CVE-2025-23090",
  "lastModified": "2025-07-18T23:15:22.337",
  "metrics": {},
  "published": "2025-01-22T02:15:34.443",
  "references": [],
  "sourceIdentifier": "support@hackerone.com",
  "vulnStatus": "Rejected"
}

ghsa-5vvm-wqc8-r5m8

Vulnerability from github

Published

2025-01-22 03:30

Modified

2025-01-22 03:30

Severity ?

7.7 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage.

This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-23090"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-22T02:15:34Z",
    "severity": "HIGH"
  },
  "details": "With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers\n but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage.\n\nThis vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.",
  "id": "GHSA-5vvm-wqc8-r5m8",
  "modified": "2025-01-22T03:30:44Z",
  "published": "2025-01-22T03:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23090"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/2575105"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2025-23090 (GCVE-0-2025-23090)

Vulnerability from cvelistv5

msrc_cve-2025-23090

Vulnerability from csaf_microsoft

fkie_cve-2025-23090

Vulnerability from fkie_nvd

ghsa-5vvm-wqc8-r5m8

Vulnerability from github

Tags

Sightings

Nomenclature