CVE-2025-5962
Last modified
CVE-2025-5962 is a high-severity vulnerability rated 7.7/10 on the CVSS scale. A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of another user on the same system. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of another user on the same system. By abusing inter-process communication calls to the history service, an attacker can view, delete, or inject arbitrary history entries, including misleading or malicious commands. This can be used to deceive another user into executing harmful actions, posing a risk of privilege misuse or unauthorized command execution through social engineering.
Metrics
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-5962?
How severe is CVE-2025-5962?
How do I fix CVE-2025-5962?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-59612Memory corruption in windows drivers while sending incorrect…6.7
- CVE-2025-59613Memory Corruption when output buffer size is smaller than in…6.7
- CVE-2025-59614Memory Corruption when sending random number generator comma…6.7
- CVE-2025-59615Memory Corruption when invoking device input/output control …7.8
- CVE-2025-59616Memory Corruption when processing multiple IOCTL calls with …7.8
- CVE-2025-59617Memory Corruption when processing multiple IOCTL calls with …7.3
- CVE-2025-5963The Postbox's configuration on macOS, specifically the prese…4.8
- CVE-2025-5964A path traversal issue in the API endpoint in M-Files Server…6.5
- CVE-2025-5965In the backup parameters, a user with high privilege is able…7.2
- CVE-2025-5966Zohocorp ManageEngine Exchange reporter Plus version 5722 an…8.1
- CVE-2025-59668Multiple versions of Central Monitor CNS-6201 contain a NULL…8.7
- CVE-2025-59669A use of hard-coded credentials vulnerability in Fortinet Fo…5.5
Are you affected by CVE-2025-5962?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST