CVE-2025-24365

Katalog CVE

CVSS 7.5 · High EPSS 0,68%

Kerentanan Improper Access Control pada dani-garcia vaultwarden. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker can obtain owner rights of other organization. Hacker should know the ID of victim organization (in real case the user can be a part of the organization as an unprivileged user) and be the owner/admin of other organization (by default you can create your own organization) in order to attack. This vulnerability is fixed in 1.33.0.

Rincian

Terbit di NVD

27 Januari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,68% peluang dieksploitasi; lebih tinggi dari 51,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-j4h8-vch3-f797 exploit · advisory vendor
• https://github.com/dani-garcia/vaultwarden/releases/tag/1.33.0 release notes