CVE-2025-0743

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to leverage the endpoint "/embedai/visits/show/<VISIT_ID>" to obtain information about the visits made by other users. The information provided by this endpoint includes IP address, userAgent and location of the user that visited the web page.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:thesamur:embedai:*:*:*:*:*:*:*:*

History

08 Oct 2025, 19:18

Type	Values Removed	Values Added
CPE		cpe:2.3:a:thesamur:embedai::::::::
References	~~() https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai -~~	() https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai - Third Party Advisory
First Time		Thesamur Thesamur embedai

18 Feb 2025, 19:15

Type	Values Removed	Values Added
CWE	~~CWE-863~~
Summary		(es) Se ha encontrado una vulnerabilidad de control de acceso inadecuado en EmbedAI 2.1 y versiones anteriores. Esta vulnerabilidad permite a un atacante autenticado aprovechar el endpoint "/embedai/visits/show/" para obtener información sobre las visitas realizadas por otros usuarios. La información proporcionada por esta endpoint incluye la dirección IP, el agente de usuario y la ubicación del usuario que visitó la página web.

30 Jan 2025, 14:15

Type	Values Removed	Values Added
CWE		CWE-863

30 Jan 2025, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-01-30 12:15

Updated : 2025-10-08 19:18

NVD link : CVE-2025-0743

Mitre link : CVE-2025-0743

CVE.ORG link : CVE-2025-0743

JSON object : View

Products Affected

thesamur

embedai

CWE

CWE-284

Improper Access Control

{"id": "CVE-2025-0743", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2025-01-30T12:15:27.707", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai", "tags": ["Third Party Advisory"], "source": "cve-coordination@incibe.es"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cve-coordination@incibe.es", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to leverage the endpoint \"/embedai/visits/show/<VISIT_ID>\" to obtain information about the visits made by other users. The information provided by this endpoint includes IP address, userAgent and location of the user that visited the web page."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad de control de acceso inadecuado en EmbedAI 2.1 y versiones anteriores. Esta vulnerabilidad permite a un atacante autenticado aprovechar el endpoint \"/embedai/visits/show/\" para obtener informaci\u00f3n sobre las visitas realizadas por otros usuarios. La informaci\u00f3n proporcionada por esta endpoint incluye la direcci\u00f3n IP, el agente de usuario y la ubicaci\u00f3n del usuario que visit\u00f3 la p\u00e1gina web."}], "lastModified": "2025-10-08T19:18:43.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:thesamur:embedai:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A81F2612-1390-41C8-99A6-710A2EBB498A", "versionEndExcluding": "2.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve-coordination@incibe.es"}