PT-2025-9999 · Fleet · Fleet

Hakivvi + 2 · Published 2025-03-06 · Updated 2025-03-13 · CVE-2025-27509

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.64.2 Fleet versions prior to 4.63.2 Fleet versions prior to 4.62.4 Fleet versions prior to 4.58.1

Description The issue allows an attacker to craft a specially-formed SAML response to forge authentication assertions. This can lead to provisioning a new administrative user account if Just-In-Time (JIT) provisioning is enabled, or creating new accounts tied to forged assertions if MDM enrollment is enabled.

Recommendations For versions prior to 4.64.2, update to version 4.64.2 or later. For versions prior to 4.63.2, update to version 4.63.2 or later. For versions prior to 4.62.4, update to version 4.62.4 or later. For versions prior to 4.58.1, update to version 4.58.1 or later.

Exploit

Fix

Special Elements Injection

Improper Authorization

Weakness Enumeration

CWE-74

CWE-285

Related Identifiers

CVE-2025-27509

GHSA-52JX-G6M5-H735

GO-2025-3505

OPENSUSE-SU-2025:14889-1

Affected Products

Fleet

References · 53

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27509.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-27509 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:14889-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3505 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27509 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-52jx-g6m5-h735 · Vendor Advisory
• https://github.com/fleetdm/fleet · Note
• https://github.com/fleetdm/fleet/security/advisories/GHSA-52jx-g6m5-h735 · Note
• https://github.com/fleetdm/fleet/commit/718c95e47ad010ad6b8ceb3f3460e921fbfc53bb · Note
• https://github.com/fleetdm/fleet/releases/tag/fleet-v4.64.2 · Note
• https://suse.com/security/cve/CVE-2025-24806 · Note
• https://suse.com/security/cve/CVE-2025-27144 · Note
• https://suse.com/security/cve/CVE-2025-24016 · Note
• https://t.me/purp_sec/363 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1899271575842742586 · Twitter Post