CVE-2025-62236
BaseFortify
Publication date: 2025-10-23
Last updated on: 2025-12-31
Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| flyfrontier | frontier_airlines | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-204 | The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Frontier Airlines website, where a publicly accessible endpoint allows anyone, including unauthenticated remote attackers, to check if an email address is associated with an account. This means attackers can verify valid email addresses, which could be used to facilitate further attacks such as phishing or account takeover attempts.
How can this vulnerability impact me? :
The vulnerability can impact you by exposing whether your email address is registered with Frontier Airlines. Attackers could use this information to target you with phishing attacks, social engineering, or attempts to compromise your account, potentially leading to unauthorized access or identity theft.