mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-12-15 20:54:43 +00:00
64 lines
2.9 KiB
JSON
64 lines
2.9 KiB
JSON
{
|
|
"id": "CVE-2025-25282",
|
|
"sourceIdentifier": "security-advisories@github.com",
|
|
"published": "2025-02-21T21:15:23.590",
|
|
"lastModified": "2025-02-24T15:15:13.620",
|
|
"vulnStatus": "Awaiting Analysis",
|
|
"cveTags": [],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. An authenticated user can exploit the Insecure Direct Object Reference (IDOR) vulnerability that may lead to unauthorized cross-tenant access (list tenant user accounts, add user account into other tenant). Unauthorized cross-tenant access: list user from other tenant (e.g., via GET /<tenant_id>/user/list), add user account to other tenant (POST /<tenant_id>/user). This issue has not yet been patched. Users are advised to reach out to the project maintainers to coordinate a fix."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "RAGFlow es un motor RAG (Retrieval-Augmented Generation) de c\u00f3digo abierto basado en una comprensi\u00f3n profunda de los documentos. Un usuario autenticado puede explotar la vulnerabilidad de referencia directa a objetos inseguros (IDOR) que puede provocar un acceso no autorizado entre inquilinos (enumerar cuentas de usuario de inquilinos, agregar una cuenta de usuario a otro inquilino). Acceso no autorizado entre inquilinos: enumerar usuarios de otros inquilinos (por ejemplo, a trav\u00e9s de GET //user/list), agregar una cuenta de usuario a otro inquilino (POST //user). Este problema a\u00fan no se ha solucionado. Se recomienda a los usuarios que se pongan en contacto con los encargados del mantenimiento del proyecto para coordinar una soluci\u00f3n."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV30": [
|
|
{
|
|
"source": "security-advisories@github.com",
|
|
"type": "Secondary",
|
|
"cvssData": {
|
|
"version": "3.0",
|
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
|
|
"baseScore": 8.1,
|
|
"baseSeverity": "HIGH",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "LOW",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "HIGH",
|
|
"availabilityImpact": "NONE"
|
|
},
|
|
"exploitabilityScore": 2.8,
|
|
"impactScore": 5.2
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "security-advisories@github.com",
|
|
"type": "Secondary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-639"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://github.com/infiniflow/ragflow/security/advisories/GHSA-wc5v-g79p-7hch",
|
|
"source": "security-advisories@github.com"
|
|
},
|
|
{
|
|
"url": "https://github.com/infiniflow/ragflow/security/advisories/GHSA-wc5v-g79p-7hch",
|
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
|
|
}
|
|
]
|
|
} |