CVE-2025-60914
BaseFortify
Publication date: 2025-11-24
Last updated on: 2025-11-28
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| craws | openatlas | to 8.12.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to sensitive information within the Openatlas system. An attacker exploiting this flaw could retrieve data that should be restricted, potentially leading to information disclosure and compromising the confidentiality of the system's data.
Can you explain this vulnerability to me?
This vulnerability is an incorrect access control issue in the Austrian Archaeological Institute Openatlas software before version 8.12.0. It allows attackers to access sensitive information by sending a specially crafted GET request to the /display_logo endpoint, which should normally be protected.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by monitoring for crafted GET requests to the /display_logo endpoint on your Openatlas server. For example, using command-line tools like curl or wget to test the endpoint for unauthorized access or unusual responses can help identify the issue. A sample command to test might be: curl -v http://<target-server>/display_logo. Additionally, network monitoring tools can be configured to alert on suspicious GET requests targeting /display_logo.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Openatlas to version 8.12.0 or later, where this incorrect access control vulnerability has been fixed. Until the upgrade can be performed, restrict access to the /display_logo endpoint via network controls such as firewalls or web application firewalls (WAF) to prevent unauthorized crafted GET requests.