CVE-2025-30064
BaseFortify
Publication date: 2025-08-27
Last updated on: 2025-08-29
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cgm | clininet | 2025.ms2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-347 | The product does not verify, or incorrectly verifies, the cryptographic signature for data. |
| CWE-912 | The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves an insufficiently secured internal function that allows an attacker to generate a session for any arbitrary user. Specifically, the decodeParam function checks the JWT but does not verify the signing algorithm used. This flaw enables an attacker to exploit the "ex:action" parameter in the VerifyUserByThrustedService function to create unauthorized sessions.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to impersonate any user by generating unauthorized sessions. This can lead to unauthorized access to user accounts, potentially exposing sensitive information, enabling privilege escalation, and compromising the integrity and confidentiality of the system.