CVE-2025-10073
BaseFortify
Publication date: 2025-09-08
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| portabilis | i-educar | to 2.10.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-10073 is a Broken Object Level Authorization (BOLA) vulnerability in Portabilis i-Educar up to version 2.10, specifically affecting the GET /module/Api/turma API endpoint. It allows any authenticated user, even those with low privileges, to bypass proper authorization checks and access sensitive academic class information by manipulating request parameters. This means unauthorized users can retrieve details about classes that they should not have access to. [1, 2]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of internal academic information such as classes, courses, and schedules. Attackers can use it to gather detailed information about the institution's academic structure, which can be used for reconnaissance or combined with other vulnerabilities to target student records. Although it does not expose individual student data directly, it compromises the confidentiality of institutional metadata and may facilitate further attacks. [1, 2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The unauthorized exposure of institutional metadata due to this vulnerability may violate data governance policies and compliance requirements. While it does not directly disclose personal student data, the leakage of sensitive academic information could still impact compliance with standards like GDPR or HIPAA by failing to adequately protect confidential institutional data. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to access the vulnerable endpoint `GET /module/Api/turma` as a non-privileged authenticated user and checking if unauthorized class information is returned. A suggested command using curl would be: curl -i -b cookie.txt 'https://<target>/module/Api/turma?oper=get&resource=turma&id=14' where 'cookie.txt' contains authentication cookies for a low-privilege user. If the response returns class data instead of a 403 Forbidden or no data, the system is vulnerable. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps are not documented in the provided resources. However, since the vulnerability is due to improper object-level authorization on the `/module/Api/turma` endpoint, it is recommended to restrict access to this API to authorized roles only (e.g., administrators, coordinators, teachers) and implement proper authorization checks. If a patch or update is available from the vendor, apply it promptly. Otherwise, consider restricting network access to the vulnerable endpoint or replacing the affected component with an alternative product. [2]