PT-2025-9685 · Pinecone · Pinecone

Treanglex · Publicado 2025-03-04 · Atualizado 2025-03-13 · CVE-2025-27155

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pinecone versions up to commit ea4c337

Description The issue concerns stored cross-site scripting in the Pinecone Simulator (pineconesim). The payload storage is temporary and will be deleted when pineconesim is restarted.

Recommendations For versions up to commit ea4c337, consider disabling the Pinecone Simulator until a fix is available to prevent potential exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-80

CWE-79

Identificadores relacionados

CVE-2025-27155

GHSA-FR62-MG2Q-7WQV

GO-2025-3500

OPENSUSE-SU-2025:14889-1

Produtos afetados

Pinecone

Referências · 44

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27155.json · Exploit
• https://github.com/matrix-org/pinecone/security/advisories/GHSA-fr62-mg2q-7wqv · Nota
• https://github.com/matrix-org/pinecone/commit/218b2801995b174085cb1c8fafe2d3aa661f85bd · Nota
• https://github.com/matrix-org/pinecone · Nota
• https://suse.com/security/cve/CVE-2025-24806 · Nota
• https://osv.dev/vulnerability/GHSA-fr62-mg2q-7wqv · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2025-25294 · Nota
• https://suse.com/security/cve/CVE-2025-27090 · Nota
• https://suse.com/security/cve/CVE-2025-24526 · Nota
• https://pkg.go.dev/vuln/GO-2025-3500 · Nota
• https://suse.com/security/cve/CVE-2025-25204 · Nota
• https://suse.com/security/cve/CVE-2025-27100 · Nota
• https://suse.com/security/cve/CVE-2025-27414 · Nota
• https://suse.com/security/cve/CVE-2025-27421 · Nota
• https://suse.com/security/cve/CVE-2025-0426 · Nota