CVE-2025-47775

Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue.

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/bullfrogsec/bullfrog/commit/ae7744ae4b3a6f8ffc2e49f501e30bf1a43d4671	Patch
https://github.com/bullfrogsec/bullfrog/releases/tag/v0.8.4	Release Notes
https://github.com/bullfrogsec/bullfrog/security/advisories/GHSA-m32f-fjw2-37v3	Exploit Vendor Advisory
https://github.com/bullfrogsec/bullfrog/security/advisories/GHSA-m32f-fjw2-37v3	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:bullfrogsec:bullfrog:*:*:*:*:*:*:*:*

History

11 Jul 2025, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-14 16:15

Updated : 2025-07-11 16:15

NVD link : CVE-2025-47775

Mitre link : CVE-2025-47775

CVE.ORG link : CVE-2025-47775

JSON object : View

Products Affected

bullfrogsec

bullfrog

CWE

CWE-201

Insertion of Sensitive Information Into Sent Data

NVD-CWE-noinfo

{"id": "CVE-2025-47775", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "published": "2025-05-14T16:15:28.807", "references": [{"url": "https://github.com/bullfrogsec/bullfrog/commit/ae7744ae4b3a6f8ffc2e49f501e30bf1a43d4671", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/bullfrogsec/bullfrog/releases/tag/v0.8.4", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/bullfrogsec/bullfrog/security/advisories/GHSA-m32f-fjw2-37v3", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/bullfrogsec/bullfrog/security/advisories/GHSA-m32f-fjw2-37v3", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-201"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue."}, {"lang": "es", "value": "Bullfrog es una acci\u00f3n de GitHub que bloquea el tr\u00e1fico saliente no autorizado en los flujos de trabajo de GitHub. Antes de la versi\u00f3n 0.8.4, el uso de TCP interrump\u00eda el bloqueo y permit\u00eda la exfiltraci\u00f3n de DNS. Esto puede provocar la omisi\u00f3n del entorno de pruebas. La versi\u00f3n 0.8.4 soluciona este problema."}], "lastModified": "2025-07-11T16:15:04.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bullfrogsec:bullfrog:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A655DA35-9EC0-42B2-AE07-C5CE762ADD8D", "versionEndExcluding": "0.8.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}