CVE-2025-13084
BaseFortify
Publication date: 2025-11-26
Last updated on: 2025-11-26
Assigner: ICS-CERT
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| groov | view_api | 4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1230 | The product prevents direct access to a resource containing sensitive information, but it does not sufficiently limit access to metadata that is derived from the original, sensitive information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the groov View API's users endpoint, which returns a list of all users along with their associated metadata, including their API keys. Access to this endpoint requires an Editor role, but it exposes API keys for all users, including Administrators, potentially allowing unauthorized access or misuse of these keys.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of API keys for all users, including administrators. This could allow attackers or unauthorized users with Editor role access to misuse these keys, potentially leading to unauthorized access, data breaches, or manipulation of the system.