CVE-2025-29997 | THREATINT

Description

This vulnerability exists in the CAP back office application due to improper authorization checks on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating API request URL to gain unauthorized access to other user accounts.

PUBLISHED Reserved 2025-03-13 | Published 2025-03-13 | Updated 2025-03-13 | Assigner CERT-In

HIGH: 8.2CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Problem types

CWE-863: Incorrect Authorization

Product status

Default status

unaffected

<2.0.4

affected

Credits

This vulnerability is reported by Mohit Gadiya. finder

References

www.cert-in.org.in/...eid=PUBVLNOTES01&VLCODE=CIVN-2025-0048 third-party-advisory

cve.org (CVE-2025-29997)

nvd.nist.gov (CVE-2025-29997)

Download JSON