github - ghsa-vpq5-jxrg-f4m3

GHSA-VPQ5-JXRG-F4M3

Vulnerability from github – Published: 2025-05-16 15:31 – Updated: 2025-05-16 15:31

Details

An Improper Access Control vulnerability was identified in the file download functionality. This vulnerability allows users to download sensitive documents without authentication, if the URL is known.

The attack requires the attacker to know the documents UUIDv4.

Severity ?

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-2306"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-16T13:15:52Z",
    "severity": "MODERATE"
  },
  "details": "An Improper Access Control vulnerability was\nidentified in the file download functionality. This vulnerability allows users\nto download sensitive documents without authentication, if the URL is known.\n\n\n\nThe attack\nrequires the attacker to know the documents UUIDv4.",
  "id": "GHSA-vpq5-jxrg-f4m3",
  "modified": "2025-05-16T15:31:02Z",
  "published": "2025-05-16T15:31:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2306"
    },
    {
      "type": "WEB",
      "url": "https://www.cirosec.de/sa/sa-2025-004"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-2306 (GCVE-0-2025-2306)

Vulnerability from cvelistv5 – Published: 2025-05-16 12:10 – Updated: 2025-05-16 13:02

Title

Improper Access Control vulnerability in LIVE CONTRACT

Summary

Severity ?

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-284 - Improper Access Control

Assigner

cirosec

References

URL

Tags

https://www.cirosec.de/sa/sa-2025-004

Impacted products

	Vendor	Product	Version
	SYNCPILOT	LIVE CONTRACT	Affected: 3 , < 5.4.12 (semver) Affected: 5.5 , < 5.5.4 (semver) Affected: 5.6 , < 5.6.3 (semver)

Credits

Felix Schmid <felix.schmid@cirosec.de>

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-2306",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-16T13:02:34.088925Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-16T13:02:39.876Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LIVE CONTRACT",
          "vendor": "SYNCPILOT",
          "versions": [
            {
              "lessThan": "5.4.12",
              "status": "affected",
              "version": "3",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5.4",
              "status": "affected",
              "version": "5.5",
              "versionType": "semver"
            },
            {
              "lessThan": "5.6.3",
              "status": "affected",
              "version": "5.6",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Felix Schmid \u003cfelix.schmid@cirosec.de\u003e"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn Improper Access Control vulnerability was\nidentified in the file download functionality. This vulnerability allows users\nto download sensitive documents without authentication, if the URL is known.\u003c/p\u003e\n\n\u003cp\u003eThe attack\nrequires the attacker to know the documents UUIDv4.\u003c/p\u003e"
            }
          ],
          "value": "An Improper Access Control vulnerability was\nidentified in the file download functionality. This vulnerability allows users\nto download sensitive documents without authentication, if the URL is known.\n\n\n\nThe attack\nrequires the attacker to know the documents UUIDv4."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-16T12:10:13.895Z",
        "orgId": "a341c0d1-ebf7-493f-a84e-38cf86618674",
        "shortName": "cirosec"
      },
      "references": [
        {
          "url": "https://www.cirosec.de/sa/sa-2025-004"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to versions\u0026nbsp;5.4.12, 5.5.4, 5.6.3 or higher."
            }
          ],
          "value": "Update to versions\u00a05.4.12, 5.5.4, 5.6.3 or higher."
        }
      ],
      "source": {
        "advisory": "SA-2025-004",
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2025-03-04T23:00:00.000Z",
          "value": "Vendor was contacted and informed about the vulnerability via email."
        },
        {
          "lang": "en",
          "time": "2025-03-04T23:00:00.000Z",
          "value": "Initial response received from vendor. Vendor acknowledged the vulnerability."
        },
        {
          "lang": "en",
          "time": "2025-03-12T23:00:00.000Z",
          "value": "Vendor informed us that the issue was resolved."
        }
      ],
      "title": "Improper Access Control vulnerability in LIVE CONTRACT",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a341c0d1-ebf7-493f-a84e-38cf86618674",
    "assignerShortName": "cirosec",
    "cveId": "CVE-2025-2306",
    "datePublished": "2025-05-16T12:10:13.895Z",
    "dateReserved": "2025-03-14T12:24:19.522Z",
    "dateUpdated": "2025-05-16T13:02:39.876Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-VPQ5-JXRG-F4M3

CVE-2025-2306 (GCVE-0-2025-2306)

Tags

Sightings

Nomenclature