CVE-2025-27822

{"id": "CVE-2025-27822", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "published": "2025-03-07T22:15:37.927", "references": [{"url": "https://backdropcms.org/security/backdrop-sa-contrib-2025-006", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the Masquerade module before 1.x-1.0.1 for Backdrop CMS. It allows people to temporarily switch to another user account. The module provides a \"Masquerade as admin\" permission to restrict people (who can masquerade) from switching to an account with administrative privileges. This permission is not always honored and may allow non-administrative users to masquerade as an administrator. This vulnerability is mitigated by the fact that an attacker must have a role with the \"Masquerade as user\" permission."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en el m\u00f3dulo Masquerade antes de la versi\u00f3n 1.x-1.0.1 para Background CMS. Permite que las personas cambien temporalmente a otra cuenta de usuario. El m\u00f3dulo proporciona un permiso \"Hacerse pasar por administrador\" para impedir que las personas (que pueden hacerse pasar por administrador) cambien a una cuenta con privilegios administrativos. Este permiso no siempre se respeta y puede permitir que usuarios no administrativos se hagan pasar por administradores. Esta vulnerabilidad se mitiga por el hecho de que un atacante debe tener un rol con el permiso \"Hacerse pasar por usuario\"."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "cve@mitre.org"}