CVE-2025-5409

Katalog CVE

CVSS 9.8 · Critical EPSS 0,61%

Kerentanan Incorrect Privilege Assignment pada mist. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in Mist Community Edition up to 4.7.1. It has been classified as critical. This affects the function create_token of the file src/mist/api/auth/views.py of the component API Token Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.7.2 is able to address this issue. The identifier of the patch is db10ecb62ac832c1ed4924556d167efb9bc07fad. It is recommended to upgrade the affected component.

Rincian

Terbit di NVD

1 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment
CWE-284: Improper Access Control

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mistio/mist.api/commit/db10ecb62ac832c1ed4924556d167efb9bc07fad patch
• https://github.com/Stolichnayer/mist-ce-account-takeover exploit · advisory pihak ketiga
• https://vuldb.com/?id.310749 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.583531 advisory pihak ketiga · vdb entry
• https://github.com/mistio/mist-ce/releases/tag/v4.7.2 release notes
• https://vuldb.com/?ctiid.310749 permissions required · vdb entry