CVE-2025-25264

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-25264
An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://certvde.com/en/advisories/VDE-2025-018/
Configurations

No configuration.

History

21 Nov 2025, 12:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : 6.5
Summary (en) A low-privileged remote attacker can take advantage of the current overly permissive CORS policy to gain access and read the responses, potentially exposing sensitive data or enabling further attacks. (en) An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system.

07 Oct 2025, 08:15

Type Values Removed Values Added
Summary (en) An unauthenticated remote attacker can take advantage of the current overly permissive CORS policy to gain access and read the responses, potentially exposing sensitive data or enabling further attacks. (en) A low-privileged remote attacker can take advantage of the current overly permissive CORS policy to gain access and read the responses, potentially exposing sensitive data or enabling further attacks.

16 Jun 2025, 12:32

Type Values Removed Values Added
Summary
  • (es) Un atacante remoto no autenticado puede aprovechar la actual política CORS excesivamente permisiva para obtener acceso y leer las respuestas, exponiendo potencialmente datos confidenciales o posibilitando más ataques.

16 Jun 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-16 10:15

Updated : 2025-11-21 12:15

NVD link : CVE-2025-25264

Mitre link : CVE-2025-25264

CVE.ORG link : CVE-2025-25264

JSON object : View

Products Affected

No product.

CWE
CWE-942

Permissive Cross-domain Policy with Untrusted Domains