github - ghsa-cqr3-h8cv-gwg3

GHSA-CQR3-H8CV-GWG3

Vulnerability from github – Published: 2025-03-31 06:30 – Updated: 2025-03-31 06:30

Details

Insecure Direct Object References (IDOR) in access control in Customer Portal before 2.1.4 on NightWolf Penetration Testing allows an attacker to access via manipulating request parameters or object references.

Severity ?

8.3 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-3013"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-31T04:15:21Z",
    "severity": "HIGH"
  },
  "details": "Insecure Direct Object References (IDOR) in access control in Customer Portal before 2.1.4 on NightWolf\u00a0Penetration Testing\u00a0allows an attacker to access via manipulating request parameters or object references.",
  "id": "GHSA-cqr3-h8cv-gwg3",
  "modified": "2025-03-31T06:30:26Z",
  "published": "2025-03-31T06:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3013"
    },
    {
      "type": "WEB",
      "url": "https://bug.report.night-wolf.io/changelogs"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2025-3013 (GCVE-0-2025-3013)

Vulnerability from cvelistv5 – Published: 2025-03-31 03:40 – Updated: 2025-03-31 15:55

Summary

Severity ?

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

CWE

CWE-285 - Improper Authorization

Assigner

FSOFT

References

URL

Tags

https://bug.report.night-wolf.io/changelogs

Impacted products

	Vendor	Product	Version
	FPT Software	NightWolf Penetration Platform	Affected: 2.1.2 , ≤ 2.1.4 (custom) Unaffected: 2.1.5 (custom)

Credits

Phan Quang Bao (quangbao368@gmail.com)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3013",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-31T15:53:42.558887Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-31T15:55:30.308Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "portal"
          ],
          "product": "NightWolf Penetration Platform",
          "vendor": "FPT Software",
          "versions": [
            {
              "lessThanOrEqual": "2.1.4",
              "status": "affected",
              "version": "2.1.2",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2.1.5",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Phan Quang Bao (quangbao368@gmail.com)"
        }
      ],
      "datePublic": "2025-03-31T03:29:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insecure Direct Object References (IDOR) in access control in Customer Portal before 2.1.4 on NightWolf\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ePenetration Testing\u0026nbsp;\u003c/span\u003eallows an attacker to access via manipulating request parameters or object references.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Insecure Direct Object References (IDOR) in access control in Customer Portal before 2.1.4 on NightWolf\u00a0Penetration Testing\u00a0allows an attacker to access via manipulating request parameters or object references."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-27",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-27: Leveraging Trust in Client"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-31T03:45:01.982Z",
        "orgId": "5ac195ad-69e7-48e7-9c1e-bfc958c39761",
        "shortName": "FSOFT"
      },
      "references": [
        {
          "url": "https://bug.report.night-wolf.io/changelogs"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2025-03-27T10:00:00.000Z",
          "value": "The reporter submits the vulnerability to security_report@fpt.com."
        },
        {
          "lang": "en",
          "time": "2025-03-28T01:00:00.000Z",
          "value": "The security team verifies the issue and provides a fixing solution."
        },
        {
          "lang": "en",
          "time": "2025-03-29T08:00:00.000Z",
          "value": "The security team releases the fix, retests the issue, and closes the vulnerability."
        },
        {
          "lang": "en",
          "time": "2025-03-31T02:00:00.000Z",
          "value": "Assign a CVE to the reporter."
        }
      ],
      "title": "Insecure direct object references (IDOR) in NightWolf Penetration Platform",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5ac195ad-69e7-48e7-9c1e-bfc958c39761",
    "assignerShortName": "FSOFT",
    "cveId": "CVE-2025-3013",
    "datePublished": "2025-03-31T03:40:04.534Z",
    "dateReserved": "2025-03-31T03:26:43.696Z",
    "dateUpdated": "2025-03-31T15:55:30.308Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-CQR3-H8CV-GWG3

CVE-2025-3013 (GCVE-0-2025-3013)

Tags

Sightings

Nomenclature