CVE-2025-3113

A valid, authenticated user with sufficient privileges and who is aware of Continuous Compliance’s internal database configurations can leverage the application’s built-in Connector functionality to access Continuous Compliance’s internal database. This allows the user to explore the internal database schema and export its data, including the properties of Connecters and Rule Sets.

CVSS

No CVSS.

References

Link	Resource
https://portal.perforce.com/s/detail/a91PA000001SeefYAC

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) Un usuario válido y autenticado con suficientes privilegios y que conozca la configuración de la base de datos interna de Continuous Compliance puede aprovechar la funcionalidad de conector integrada de la aplicación para acceder a dicha base de datos. Esto le permite explorar el esquema de la base de datos interna y exportar sus datos, incluyendo las propiedades de los conectores y los conjuntos de reglas.

17 Apr 2025, 07:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-17 07:15

Updated : 2026-06-17 09:19

NVD link : CVE-2025-3113

Mitre link : CVE-2025-3113

CVE.ORG link : CVE-2025-3113

JSON object : View

Products Affected

No product.

CWE

CWE-284

Improper Access Control

{"id": "CVE-2025-3113", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3113", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-04-17T18:41:49.910846Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@puppet.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@puppet.com", "affectedData": [{"vendor": "Perforce", "product": "Delphix", "versions": [{"status": "affected", "version": "0", "lessThan": "2025.2.0.1", "versionType": "custom"}], "packageName": "Continuous Compliance, Containerized Masking", "defaultStatus": "unaffected"}]}], "published": "2025-04-17T07:15:43.790", "references": [{"url": "https://portal.perforce.com/s/detail/a91PA000001SeefYAC", "source": "security@puppet.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@puppet.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "A valid, authenticated user with sufficient privileges and who is aware of Continuous Compliance\u2019s internal database configurations can leverage the application\u2019s built-in Connector functionality to access Continuous Compliance\u2019s internal database. This allows the user to explore the internal database schema and export its data, including the properties of Connecters and Rule Sets."}, {"lang": "es", "value": "Un usuario v\u00e1lido y autenticado con suficientes privilegios y que conozca la configuraci\u00f3n de la base de datos interna de Continuous Compliance puede aprovechar la funcionalidad de conector integrada de la aplicaci\u00f3n para acceder a dicha base de datos. Esto le permite explorar el esquema de la base de datos interna y exportar sus datos, incluyendo las propiedades de los conectores y los conjuntos de reglas."}], "lastModified": "2026-06-17T09:19:12.390", "sourceIdentifier": "security@puppet.com"}