CVE-2025-1568
Last modified
CVE-2025-1568 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Access Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 16063.87.0 allows an attacker with a registered Gerrit account to inject malicious code into ChromeOS projects and potentially achieve Remote Code Execution and Denial of Service via editing trusted pipelines by insufficient access controls and misconfigurations in Gerrit's project.config.. EPSS estimates a 0.35% chance of exploitation in the next 30 days.
Description
Access Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 16063.87.0 allows an attacker with a registered Gerrit account to inject malicious code into ChromeOS projects and potentially achieve Remote Code Execution and Denial of Service via editing trusted pipelines by insufficient access controls and misconfigurations in Gerrit's project.config.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Chrome Os | 16063.87.0 |
References
- https://issuetracker.google.com/issues/374279912Issue Tracking, Mailing List
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-1568?
How severe is CVE-2025-1568?
How do I fix CVE-2025-1568?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-15672The ChamaWP WordPress plugin before 1.0.13 does not properl…8.1
- CVE-2025-15673The Import and export users and customers WordPress plugin b…4.9
- CVE-2025-15674The Passster WordPress plugin before 4.3.7 does not restrict…2.7
- CVE-2025-15675The Charitable WordPress plugin before 1.8.5.3 does not san…4.8
- CVE-2025-15677The GeoDirectory WordPress plugin before 2.8.110 does not s…3.5
- CVE-2025-15678The Nexter Blocks WordPress plugin before 5.0.2 does not sa…6.1
- CVE-2025-15680TBEA TLogger V2.1.0.0B0.0.0.0 exposes a UART interface on th…2.4
- CVE-2025-15681TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication byp…9.2
- CVE-2025-15682TBEA TLogger V2.1.0.0B0.0.0.0 contains an unauthenticated re…8.7
- CVE-2025-15683TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthentica…8.8
- CVE-2025-15684A vulnerability was detected in Open5GS up to 2.7.6. Affecte…5.3
- CVE-2025-15685A flaw has been found in Open5GS up to 2.7.1. Affected by th…6.3
Are you affected by CVE-2025-1568?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST