CVE-2025-7021

Katalog CVE

CVSS 6.5 · Medium EPSS 0,36%

Kerentanan User Interface (UI) Misrepresentation of Critical Information pada openai operator. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Fullscreen API Spoofing and UI Redressing in the handling of Fullscreen API and UI rendering in OpenAI Operator SaaS on Web allows a remote attacker to capture sensitive user input (e.g., login credentials, email addresses) via displaying a deceptive fullscreen interface with overlaid fake browser controls and a distracting element (like a cookie consent screen) to obscure fullscreen notifications, tricking the user into interacting with the malicious site.

Rincian

Terbit di NVD

10 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-451: User Interface (UI) Misrepresentation of Critical Information

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/google/security-research/security/advisories/GHSA-mmgx-755h-wr74 exploit · advisory pihak ketiga