CVE-2025-3575 | THREATINT

Description

Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario" parameter in "/helper/Familia/establecerUsuarioSeleccion" endpoint.

PUBLISHED Reserved 2025-04-14 | Published 2025-04-15 | Updated 2025-04-15 | Assigner INCIBE

HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-639 Authorization Bypass Through User-Controlled Key

Product status

Default status

unaffected

v05.29.0907

affected

References

www.incibe.es/...-direct-object-reference-deporsite-t-innova

cve.org (CVE-2025-3575)

nvd.nist.gov (CVE-2025-3575)

Download JSON