Red Hat Process Automation 7 CVE-2025-58713

This vulnerability presents moderate real-world risk with several limiting factors. The CVSS score of 6.4 reflects a local attack vector (AV:L), high attack complexity (AC:H suggesting non-trivial exploitation conditions), and high privilege requirement (PR:H indicating the attacker must already be a member of the root group). The SSVC framework assessment would classify this as having a constrained attack surface: exploitation requires both container command execution capability AND membership in the root group, which limits the threat actor pool. However, in containerized environments where non-root users are intentionally given limited capabilities or where containers run with less-strict privilege boundaries, an attacker with initial container access and group membership could escalate to full root control. The impact (confidentiality, integrity, availability all high) is severe, but the prerequisite conditions moderate the practical risk. Organizations using Red Hat Process Automation 7 in containerized deployments with elevated privileges for non-root users should prioritize patching; those with strict container security postures (read-only root filesystem, minimal group memberships) face lower risk.

An attacker gains container command execution as a non-root user (e.g., via a compromised application running in the container or a supply-chain attack). If that user is a member of the root group (GID 0), they can directly write to /etc/passwd due to its group-writable permissions. The attacker appends a new line such as 'rootprivesc:x:0:0::/root:/bin/bash' and then switches user via 'su rootprivesc' with no password (or a blank password field), achieving UID 0 access and full container root privileges. This scenario is realistic in development or testing environments where containers run with relaxed privilege constraints, or in misconfigured production deployments where non-root application users retain group memberships they do not need.