CVE-2025-3013

Insecure Direct Object References (IDOR) in access control in Customer Portal before 2.1.4 on NightWolf Penetration Testing allows an attacker to access via manipulating request parameters or object references.

CVSS

No CVSS.

References

Link	Resource
https://bug.report.night-wolf.io/changelogs

Configurations

No configuration.

History

01 Apr 2025, 20:26

Type	Values Removed	Values Added
Summary		(es) Las referencias directas a objetos inseguras (IDOR) en Customer Portal anterior a la versión 2.1.4 en las pruebas de penetración de NightWolf permiten que un atacante acceda mediante la manipulación de parámetros de solicitud o referencias de objetos.

31 Mar 2025, 04:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-03-31 04:15

Updated : 2025-04-01 20:26

NVD link : CVE-2025-3013

Mitre link : CVE-2025-3013

CVE.ORG link : CVE-2025-3013

JSON object : View

Products Affected

No product.

CWE

CWE-285

Improper Authorization

{"id": "CVE-2025-3013", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "5ac195ad-69e7-48e7-9c1e-bfc958c39761", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-03-31T04:15:21.297", "references": [{"url": "https://bug.report.night-wolf.io/changelogs", "source": "5ac195ad-69e7-48e7-9c1e-bfc958c39761"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "5ac195ad-69e7-48e7-9c1e-bfc958c39761", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "Insecure Direct Object References (IDOR) in access control in Customer Portal before 2.1.4 on NightWolf\u00a0Penetration Testing\u00a0allows an attacker to access via manipulating request parameters or object references."}, {"lang": "es", "value": "Las referencias directas a objetos inseguras (IDOR) en Customer Portal anterior a la versi\u00f3n 2.1.4 en las pruebas de penetraci\u00f3n de NightWolf permiten que un atacante acceda mediante la manipulaci\u00f3n de par\u00e1metros de solicitud o referencias de objetos."}], "lastModified": "2025-04-01T20:26:30.593", "sourceIdentifier": "5ac195ad-69e7-48e7-9c1e-bfc958c39761"}