CVE-2025-43703

An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API (even though the attacker has no knowledge of an API key) through approaches such as scripts or the SRC attribute of an IMG element. NOTE: this issue exists because of an incomplete fix for CVE-2024-32484.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/ankitects/anki/pull/3925	Patch Issue Tracking
https://github.com/ankitects/anki/pull/3925/commits/24bca15fd3d9dc386916509eb2d4862d1184e709	Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:ankitects:anki:*:*:*:*:*:*:*:*

History

09 Oct 2025, 14:56

Type	Values Removed	Values Added
First Time		Ankitects anki Ankitects
Summary		(es) Se descubrió un problema en Ankitects Anki hasta la versión 25.02. Un mazo compartido manipulado puede permitir que un atacante acceda a la API interna (aunque desconozca la clave de API) mediante métodos como scripts o el atributo SRC de un elemento IMG. NOTA: Este problema existe debido a una corrección incompleta de CVE-2024-32484.
CPE		cpe:2.3:a:ankitects:anki::::::::
References	~~() https://github.com/ankitects/anki/pull/3925 -~~	() https://github.com/ankitects/anki/pull/3925 - Patch, Issue Tracking
References	~~() https://github.com/ankitects/anki/pull/3925/commits/24bca15fd3d9dc386916509eb2d4862d1184e709 -~~	() https://github.com/ankitects/anki/pull/3925/commits/24bca15fd3d9dc386916509eb2d4862d1184e709 - Patch

16 Apr 2025, 22:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-16 22:15

Updated : 2025-10-09 14:56

NVD link : CVE-2025-43703

Mitre link : CVE-2025-43703

CVE.ORG link : CVE-2025-43703

JSON object : View

Products Affected

ankitects

anki

CWE

CWE-830

Inclusion of Web Functionality from an Untrusted Source

{"id": "CVE-2025-43703", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2025-04-16T22:15:15.083", "references": [{"url": "https://github.com/ankitects/anki/pull/3925", "tags": ["Patch", "Issue Tracking"], "source": "cve@mitre.org"}, {"url": "https://github.com/ankitects/anki/pull/3925/commits/24bca15fd3d9dc386916509eb2d4862d1184e709", "tags": ["Patch"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-830"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API (even though the attacker has no knowledge of an API key) through approaches such as scripts or the SRC attribute of an IMG element. NOTE: this issue exists because of an incomplete fix for CVE-2024-32484."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Ankitects Anki hasta la versi\u00f3n 25.02. Un mazo compartido manipulado puede permitir que un atacante acceda a la API interna (aunque desconozca la clave de API) mediante m\u00e9todos como scripts o el atributo SRC de un elemento IMG. NOTA: Este problema existe debido a una correcci\u00f3n incompleta de CVE-2024-32484."}], "lastModified": "2025-10-09T14:56:21.430", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ankitects:anki:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2EC2D4F-E98B-4E6C-A4F4-17BE7930003C", "versionEndIncluding": "25.02"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}