CVE-2025-48497
BaseFortify
Publication date: 2025-06-26
Last updated on: 2025-09-30
Assigner: JPCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| irohasoft | iroha_board | to 0.10.13 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) issue in iroha Board versions v0.10.12 and earlier. It allows an attacker to trick a logged-in user into accessing a specially crafted URL, which results in the attacker being able to register arbitrary learning histories on behalf of the user without their consent. [1]
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker to manipulate your learning history data without your knowledge or permission if you are logged into the affected iroha Board software. This could lead to inaccurate or maliciously altered records within the system. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this CSRF vulnerability involves monitoring for users accessing specially crafted URLs while logged in to iroha Board versions v0.10.12 and earlier. Since the vulnerability allows arbitrary learning histories to be registered via such URLs, you can look for unusual or unexpected POST requests or URL patterns targeting the learning history registration endpoints. Specific commands are not provided in the resources, but general approaches include using web server logs to search for suspicious requests or employing web application firewalls (WAF) to detect CSRF attack patterns. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the iroha Board software to version v0.10.13, which addresses the CSRF vulnerability CVE-2025-48497 along with other security issues. [1]