CVE-2025-41404
BaseFortify
Publication date: 2025-06-26
Last updated on: 2025-09-30
Assigner: JPCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| irohasoft | iroha_board | to 0.10.13 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-425 | The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Direct request ('Forced Browsing') issue in iroha Board versions v0.10.12 and earlier. It allows an attacker who can log in to the affected product to view non-public contents by bypassing normal access controls.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker with login access to view non-public content that they should not normally have access to, potentially leading to unauthorized disclosure of sensitive information.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update iroha Board to version v0.10.13 or later, as the issue is fixed in these versions. [1]