CVE-2025-55795

Katalog CVE

CVSS 3.5 · Low EPSS 0,30%

Kerentanan Improper Access Control pada openml frontend. Skor CVSS 3.1 3.5 (Low) menurut CISA ADP.

Deskripsi (NVD)

The openml/openml.org web application version v2.0.20241110 uses incremental user IDs and insufficient email ownership verification during email update workflows. An authenticated attacker controlling a user account with a lower user ID can update their email address to that of another user with a higher user ID without proper verification. This results in the victim's email being reassigned to the attacker's account, causing the victim to be locked out immediately and unable to log in. The vulnerability leads to denial of service via account lockout but does not grant the attacker direct access to the victim's private data.

Rincian

Terbit di NVD

29 September 2025

Terakhir diubah

29 September 2026

Status NVD

Analyzed

CVSS 3.1

3.5 (Low), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 21,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openml/openml.org/security/advisories/GHSA-87c5-mc8v-xf7r exploit · advisory vendor
• https://github.com/openml product
• https://github.com/openml/openml.org product