CVE-2025-54129
BaseFortify
Publication date: 2025-07-21
Last updated on: 2025-08-22
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| psu | haxiam | to 11.0.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-204 | The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in HAXiam (a packaging wrapper for HAXcms) allows an attacker to determine whether a user account exists by observing the application's response codes. Specifically, the application returns a 200 response for valid user data requests and a 404 response for invalid users. An authenticated attacker can automate requests to brute force usernames and identify valid accounts. This information can then be used with other vulnerabilities, such as missing authorization checks, to enumerate and potentially deface other users' sites. The issue is fixed in version 11.0.5.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker to discover valid user accounts through brute force enumeration. This can lead to further attacks, such as unauthorized access or defacement of user sites, especially if combined with other security weaknesses like lack of proper authorization checks.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to request user data and observing the HTTP response codes. Specifically, sending requests for user data and checking if valid users return a 200 response while invalid users return a 404 response indicates the vulnerability. Automated tools can be used to brute force usernames and analyze responses to identify valid accounts. Specific commands are not provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade HAXiam to version 11.0.5 or later, where this issue is fixed. Additionally, restricting access to user data endpoints and implementing proper authorization checks can help reduce the risk of user enumeration and subsequent attacks.