CVE-2025-62293
BaseFortify
Publication date: 2025-11-20
Last updated on: 2025-11-24
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| soplanning | soplanning | to 1.55.00 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in SOPlanning involves Broken Access Control in the /status endpoint. Because the Project Status functionality lacks proper permission checks, an authenticated attacker can add, edit, and delete any status without authorization.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability could manipulate project status information by adding, editing, or deleting statuses. This could lead to misinformation, disruption of project tracking, and potential misuse of the system's status data.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade SOPlanning to version 1.55 or later, where the issue has been fixed.