CVE-2025-1501 | THREATINT

Description

An access control vulnerability was discovered in the Request Trace and Download Trace functionalities of CMC before 25.1.0 due to a specific access restriction not being properly enforced for users with limited privileges. An authenticated user with limited privileges can request and download trace files due to improper access restrictions, potentially exposing unauthorized network data.

PUBLISHED Reserved 2025-02-20 | Published 2025-08-26 | Updated 2025-08-26 | Assigner Nozomi

MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

MEDIUM: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Problem types

CWE-863 Incorrect Authorization

Product status

Default status

unaffected

Any version before 25.1.0

affected

Credits

This issue was confirmed by Nozomi Networks after a bug reported by one of our Customers. other

References

security.nozominetworks.com/NN-2025:3-01

cve.org (CVE-2025-1501)

nvd.nist.gov (CVE-2025-1501)

Download JSON