CVE-2025-10282 - Vulnerability Details - OpenCVE

BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00032.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Blsops	Bbot

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products
Blsops	Bbot

Advisories

Source	ID	Title
Github GHSA	GHSA-p3v4-c93g-cmhw	BBOT's gitlab.py exposes globally configured "gitlab" API key

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://blog.blacklanternsecurity.com/p/bbot-security-advisory-gitdumper

History

Fri, 10 Oct 2025 11:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Blsops Blsops bbot
Vendors & Products		Blsops Blsops bbot

Thu, 09 Oct 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 09 Oct 2025 16:00:00 +0000

Type	Values Removed	Values Added
Description		BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.
Title		GitLab Domain Confusion in gitlab Leaks API Key
Weaknesses		CWE-200
References		https://blog.blacklanternsecurity.com/p/bbot-security-advisory-gitdumper
Metrics		cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: BLSOPS

Published: 2025-10-09T15:46:10.669Z

Updated: 2025-10-09T19:03:04.124Z

Reserved: 2025-09-11T16:19:03.671Z

Link: CVE-2025-10282

Vulnrichment

Updated: 2025-10-09T19:03:00.544Z

NVD

Status : Awaiting Analysis

Published: 2025-10-09T16:15:43.810

Modified: 2025-10-14T19:37:28.107

Link: CVE-2025-10282

Redhat

No data.

OpenCVE Enrichment

Updated: 2025-10-10T11:18:05Z

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-10282", "assignerOrgId": "27b6da8a-f51d-48d9-9eef-9b7f3405d20d", "state": "PUBLISHED", "assignerShortName": "BLSOPS", "dateReserved": "2025-09-11T16:19:03.671Z", "datePublished": "2025-10-09T15:46:10.669Z", "dateUpdated": "2025-10-09T19:03:04.124Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://pypi.org/project/bbot/", "defaultStatus": "unaffected", "packageName": "bbot", "platforms": ["Linux"], "product": "bbot", "repo": "https://github.com/blacklanternsecurity/bbot", "vendor": "BLSOPS, LLC", "versions": [{"lessThanOrEqual": "2.6.1", "status": "affected", "version": "0.0.0", "versionType": "2.7.1"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL."}], "value": "BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL."}], "impacts": [{"capecId": "CAPEC-94", "descriptions": [{"lang": "en", "value": "CAPEC-94 Man in the Middle Attack"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "27b6da8a-f51d-48d9-9eef-9b7f3405d20d", "shortName": "BLSOPS", "dateUpdated": "2025-10-09T15:55:05.919Z"}, "references": [{"url": "https://blog.blacklanternsecurity.com/p/bbot-security-advisory-gitdumper"}], "source": {"discovery": "UNKNOWN"}, "title": "GitLab Domain Confusion in gitlab Leaks API Key", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-09T19:02:56.555078Z", "id": "CVE-2025-10282", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-09T19:03:04.124Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10282", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-09T19:02:56.555078Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-09T19:03:00.544Z"}}], "cna": {"title": "GitLab Domain Confusion in gitlab Leaks API Key", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-94", "descriptions": [{"lang": "en", "value": "CAPEC-94 Man in the Middle Attack"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/blacklanternsecurity/bbot", "vendor": "BLSOPS, LLC", "product": "bbot", "versions": [{"status": "affected", "version": "0.0.0", "versionType": "2.7.1", "lessThanOrEqual": "2.6.1"}], "platforms": ["Linux"], "packageName": "bbot", "collectionURL": "https://pypi.org/project/bbot/", "defaultStatus": "unaffected"}], "references": [{"url": "https://blog.blacklanternsecurity.com/p/bbot-security-advisory-gitdumper"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.", "supportingMedia": [{"type": "text/html", "value": "BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "27b6da8a-f51d-48d9-9eef-9b7f3405d20d", "shortName": "BLSOPS", "dateUpdated": "2025-10-09T15:55:05.919Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10282", "state": "PUBLISHED", "dateUpdated": "2025-10-09T19:03:04.124Z", "dateReserved": "2025-09-11T16:19:03.671Z", "assignerOrgId": "27b6da8a-f51d-48d9-9eef-9b7f3405d20d", "datePublished": "2025-10-09T15:46:10.669Z", "assignerShortName": "BLSOPS"}, "dataVersion": "5.1"}