CVE-2025-1501
Last modified
CVE-2025-1501 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. An access control vulnerability was discovered in the Request Trace and Download Trace functionalities of CMC before 25.1.0 due to a specific access restriction not being properly enforced for users with limited privileges. An authenticated user with limited privileges can request and download trace files due to improper access restrictions, potentially exposing unauthorized network data.. EPSS estimates a 0.19% chance of exploitation in the next 30 days.
Description
An access control vulnerability was discovered in the Request Trace and Download Trace functionalities of CMC before 25.1.0 due to a specific access restriction not being properly enforced for users with limited privileges. An authenticated user with limited privileges can request and download trace files due to improper access restrictions, potentially exposing unauthorized network data.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-1501?
How severe is CVE-2025-1501?
How do I fix CVE-2025-1501?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-15004A vulnerability was identified in DedeCMS up to 5.7.118. Thi…8.8
- CVE-2025-15005A security flaw has been discovered in CouchCMS up to 2.4. A…3.7
- CVE-2025-15006A weakness has been identified in Tenda WH450 1.0.0.18. Affe…9.8
- CVE-2025-15007A security vulnerability has been detected in Tenda WH450 1.…9.8
- CVE-2025-15008A vulnerability was detected in Tenda WH450 1.0.0.18. This a…9.8
- CVE-2025-15009A flaw has been found in liweiyi ChestnutCMS up to 1.5.8. Th…8.8
- CVE-2025-15010A vulnerability has been found in Tenda WH450 1.0.0.18. This…9.8
- CVE-2025-15011A vulnerability was found in code-projects Simple Stock Syst…9.8
- CVE-2025-15012A vulnerability was determined in code-projects Refugee Food…9.8
- CVE-2025-15013A vulnerability was identified in floooh sokol up to 5d11344…5.3
- CVE-2025-15014A security flaw has been discovered in loganhong php loganSi…6.3
- CVE-2025-15015Enterprise Cloud Database developed by Ragic has a Arbitrary…8.7
Are you affected by CVE-2025-1501?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST