CVE-2025-59333

Katalog CVE

CVSS 8.1 · High EPSS 0,39%

Kerentanan Improper Access Control pada executeautomation mcp database server. Skor CVSS 3.1 8.1 (High) menurut github.com.

Deskripsi (NVD)

The mcp-database-server (MCP Server) 1.1.0 and earlier, as distributed via the npm package @executeautomation/database-server, fails to implement adequate security controls to properly enforce a "read-only" mode. This vulnerability affects only the npm distribution; other distributions are not impacted. As a result, the server is susceptible to abuse and attacks on affected database systems such as PostgreSQL, and potentially others that expose elevated functionalities. These attacks may lead to denial of service and other unexpected behaviors.

Rincian

Terbit di NVD

16 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/executeautomation/mcp-database-server/security/advisories/GHSA-65hm-pwj5-73pw exploit · advisory vendor