CVE-2025-25207 — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2025-25207

CVSS 5.7 · Medium EPSS 0,27%

Kerentanan Allocation of Resources Without Limits or Throttling. Skor CVSS 3.1 5.7 (Medium) menurut redhat.com.

Deskripsi (NVD)

The Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security. Authorino allows the users with developer persona to add callbacks to be executed to HTTP endpoints once the authorization process is completed. It was found that an attacker with developer persona access can add a large number of those callbacks to be executed by Authorino and as the authentication policy is enforced by a single instance of the service, this leada to a Denial of Service in Authorino while processing the post-authorization callbacks.

Rincian

Terbit di NVD: 9 Juni 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Deferred
CVSS 3.1: 5.7 (Medium), sumber redhat.com
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-770: Allocation of Resources Without Limits or Throttling
EPSS (30 hari): 0,27% peluang dieksploitasi; lebih tinggi dari 17,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.