CVE-2025-13808

216.73.216.204

· Published 01/12/2025 05:16 · Modified 04/12/2025 20:21

Labels: CVE-2025-13808 2025-12-01 CVE-2025-13808 CWE-266 [email protected]

Essential information

Published: 01/12/2025 05:16
Modified: 04/12/2025 20:21
Author: —
Creator: —
CVSS: 6.9 MEDIUM (v3) 6.9 MEDIUM (v4.0)
CISA KEV: No
CWE: —
CVSS vector: —

CVSS metrics

Description

A flaw has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this vulnerability is the function update of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/UserController.java of the component User Profile Handler. This manipulation of the argument ID causes improper authorization. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

NVD status

Status: Analyzed — CVE has had analysis completed and all data associations made.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
orionsec / orion-ops	`cpe:2.3:a:orionsec:orion-ops::::::::`