CVE-2025-55796

Katalog CVE

CVSS 7.5 · High EPSS 0,59%

Kerentanan Uncontrolled Resource Consumption pada openml frontend. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

The openml/openml.org web application version v2.0.20241110 uses predictable MD5-based tokens for critical user workflows such as signup confirmation, password resets, email confirmation resends, and email change confirmation. These tokens are generated by hashing the current timestamp formatted as "%d %H:%M:%S" without incorporating any user-specific data or cryptographic randomness. This predictability allows remote attackers to brute-force valid tokens within a small time window, enabling unauthorized account confirmation, password resets, and email change approvals, potentially leading to account takeover.

Rincian

Terbit di NVD

18 November 2025

Terakhir diubah

29 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openml/openml.org/security/advisories/GHSA-xfjh-gf9p-8qr6 exploit · advisory vendor
• https://github.com/openml product
• https://github.com/openml/openml.org product