CVE-2025-0637

It has been found that the Beta10 software does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actor, without authentication, to access private areas and/or areas intended for other roles. The vulnerability has been identified at least in the file or path ‘/app/tools.html’.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.incibe.es/en/incibe-cert/notices/aviso/inadequate-access-control-beta10

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) Se ha detectado que el software Beta10 no contempla un control adecuado de las autorizaciones en múltiples áreas de la aplicación. Esta deficiencia podría permitir a un actor malintencionado acceder, sin autenticación, a áreas privadas y/o destinadas a otros roles. La vulnerabilidad ha sido identificada al menos en el archivo o ruta ‘/app/tools.html’.

23 Jan 2025, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-01-23 16:15

Updated : 2026-06-17 08:26

NVD link : CVE-2025-0637

Mitre link : CVE-2025-0637

CVE.ORG link : CVE-2025-0637

JSON object : View

Products Affected

No product.

CWE

CWE-287

Improper Authentication

{"id": "CVE-2025-0637", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0637", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-01-23T15:59:01.427761Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve-coordination@incibe.es", "affectedData": [{"vendor": "Beta10", "product": "Beta10", "versions": [{"status": "affected", "version": "all versions"}], "defaultStatus": "unaffected"}]}], "published": "2025-01-23T16:15:36.617", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/inadequate-access-control-beta10", "source": "cve-coordination@incibe.es"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "It has been found that the Beta10 software does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actor, without authentication, to access private areas and/or areas intended for other roles. The vulnerability has been identified at least in the file or path \u2018/app/tools.html\u2019."}, {"lang": "es", "value": "Se ha detectado que el software Beta10 no contempla un control adecuado de las autorizaciones en m\u00faltiples \u00e1reas de la aplicaci\u00f3n. Esta deficiencia podr\u00eda permitir a un actor malintencionado acceder, sin autenticaci\u00f3n, a \u00e1reas privadas y/o destinadas a otros roles. La vulnerabilidad ha sido identificada al menos en el archivo o ruta \u2018/app/tools.html\u2019."}], "lastModified": "2026-06-17T08:26:52.980", "sourceIdentifier": "cve-coordination@incibe.es"}