CVE-2025-62717
BaseFortify
Publication date: 2025-10-24
Last updated on: 2025-10-28
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| emlog | emlog | 2.5.23 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Emlog Pro version 2.5.23 is due to a session verification code error caused by a clearing logic error. It allows the verification code, which is supposed to be used only once for email verification, to be reused anywhere an email verification code is required.
How can this vulnerability impact me? :
The vulnerability could allow an attacker to reuse a verification code multiple times, potentially bypassing email verification steps. This could lead to unauthorized actions or access where email verification is required.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update Emlog Pro to a version that includes the fix from commit 1f726df, as this resolves the session verification code clearing logic error. Until the update is applied, avoid relying on email verification codes for critical security functions, as the verification code could be reused.