{"answers":{"affected":"1 open source package ship an affected version, including github.com/Xe/x.","exploited":"There is no known exploitation of CVE-2025-24369 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-24369 is a low-severity vulnerability in Xe x, published on 27 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-24369 and fix it if it is affected.\n\nWhat it is: CVE-2025-24369 is a low-severity vulnerability in Xe x, published on 27 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-24369 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/Xe/x (Go): affected all versions; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-24369/ (Markdown: https://insights.sbomify.com/CVE-2025-24369/index.md)","id":"CVE-2025-24369","markdown":"https://insights.sbomify.com/CVE-2025-24369/index.md","name":"CVE-2025-24369","record":{"aliases":["GHSA-56w8-8ppj-2p4f","GO-2025-3424","openSUSE-SU-2025:15847-1"],"analysis":{"component_type":"server_software","fix_type":"patch","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Bot protection tool","requires_auth":"low_privilege","summary":"Attackers can bypass Anubis bot protection by requesting a zero-difficulty challenge, allowing unauthorized scraping.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":2.3,"severity":"low","source":"cna","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-807","name":"Reliance on Untrusted Inputs in a Security Decision"}],"description":"Anubis is a tool that allows administrators to protect bots against AI scrapers through bot-checking heuristics and a proof-of-work challenge to discourage scraping from multiple IP addresses. Anubis allows attackers to bypass the bot protection by requesting a challenge, formulates any nonce (such as 42069), and then passes the challenge with difficulty zero. Commit e09d0226a628f04b1d80fd83bee777894a45cd02 fixes this behavior by not using a client-specified difficulty value.","ecosystems":["Go","openSUSE:Tumbleweed"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Anubis has a bot protection bypass when a sophisticated attacker asks to pass a challenge of difficulty 0","id":"CVE-2025-24369","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"security_feature_bypass","year":"2025"},"n_packages":2,"n_references":4,"next":{"headline":"Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass","id":"CVE-2025-24370"},"packages":[{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"github.com/Xe/x","purl":"pkg:golang/github.com/Xe/x","source":"GO-2025-3424"},{"ecosystem":"openSUSE:Tumbleweed","fixed":["1.24.0-1.1"],"introduced":["0"],"last_affected":[],"package":"anubis","purl":"pkg:rpm/opensuse/anubis\u0026distro=openSUSE%20Tumbleweed","source":"openSUSE-SU-2025:15847-1"}],"prev":{"headline":"Cacti has a SQL Injection vulnerability when using tree rules through Automation API","id":"CVE-2025-24368"},"products":["x"],"published":"2025-01-27","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"openSUSE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-01-28","vendors":["Xe"]},"summary":"Attackers can bypass Anubis bot protection by requesting a zero-difficulty challenge, allowing unauthorized scraping.","url":"https://insights.sbomify.com/CVE-2025-24369/"}