CVE-2025-12790
BaseFortify
Publication date: 2025-11-06
Last updated on: 2025-11-12
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rubygems | mqtt | 3.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-29 | The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a flaw in the Rubygem MQTT package where, by default, hostname validation is not performed. This lack of validation can allow an attacker to perform a Man-in-the-Middle (MITM) attack by intercepting and potentially altering the communication between the client and the MQTT server.
How can this vulnerability impact me? :
The vulnerability can impact you by exposing your MQTT communications to Man-in-the-Middle (MITM) attacks. This means an attacker could intercept, read, or modify the data being transmitted, leading to potential loss of confidentiality and integrity of your information.