CVE-2025-48695

{"id": "CVE-2025-48695", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.1}]}, "published": "2025-05-23T05:15:25.310", "references": [{"url": "https://github.com/michaelcheung-research/Vulnerability-Disclosure/blob/main/CVE-2025-CyberDava1/README.md?plain=1", "source": "cve@mitre.org"}, {"url": "https://www.cyberdava.com", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-266"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in CyberDAVA before 1.1.20. A privilege escalation vulnerability allows a low-privileged user to escalate their privilege by abusing the following API due to the lack of access control: /api/v2/users/user/<user id>/role/ROLE/<Target role> (admin access can be achieved)."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en CyberDAVA antes de la versi\u00f3n 1.1.20. Una vulnerabilidad de escalada de privilegios permite que un usuario con pocos privilegios aumente sus privilegios abusando de la siguiente API debido a la falta de control de acceso: /api/v2/users/user//role/ROLE/ (se puede obtener acceso de administrador)."}], "lastModified": "2025-05-23T15:54:42.643", "sourceIdentifier": "cve@mitre.org"}