CVE-2025-1007 - Vulnerability Details - OpenCVE

In OpenVSX version v0.9.0 to v0.20.0, the /user/namespace/{namespace}/details API allows a user to edit all namespace details, even if the user is not a namespace Owner or Contributor. The details include: name, description, website, support link and social media links. The same issues existed in /user/namespace/{namespace}/details/logo and allowed a user to change the logo.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://github.com/eclipse/openvsx/security/advisories/GHSA-wc7c-xq2f-qp4h

History

Wed, 19 Feb 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 19 Feb 2025 08:45:00 +0000

Type	Values Removed	Values Added
Description		In OpenVSX version v0.9.0 to v0.20.0, the /user/namespace/{namespace}/details API allows a user to edit all namespace details, even if the user is not a namespace Owner or Contributor. The details include: name, description, website, support link and social media links. The same issues existed in /user/namespace/{namespace}/details/logo and allowed a user to change the logo.
Title		Improper Authorization in /user/namespace/{namespace}/details
Weaknesses		CWE-283 CWE-285
References		https://github.com/eclipse/openvsx/security/advisories/GHSA-wc7c-xq2f-qp4h
Metrics		cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: eclipse

Published: 2025-02-19T08:40:58.325Z

Updated: 2025-02-19T19:36:50.732Z

Reserved: 2025-02-03T22:18:13.955Z

Link: CVE-2025-1007

Vulnrichment

Updated: 2025-02-19T19:36:44.155Z

NVD

Status : Received

Published: 2025-02-19T09:15:10.117

Modified: 2025-02-19T09:15:10.117

Link: CVE-2025-1007

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-1007", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "state": "PUBLISHED", "assignerShortName": "eclipse", "dateReserved": "2025-02-03T22:18:13.955Z", "datePublished": "2025-02-19T08:40:58.325Z", "dateUpdated": "2025-02-19T19:36:50.732Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "OpenVSX", "repo": "https://github.com/eclipse/openvsx/", "vendor": "Eclipse Foundation", "versions": [{"lessThanOrEqual": "0.20.0", "status": "affected", "version": "0.9.0", "versionType": "semver"}, {"status": "unaffected", "version": "0.19.1", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Abdel Adim smaury Oisfi of Shielder"}, {"lang": "en", "type": "finder", "value": "Andrea Cappa zi0Black of Aptos Labs"}, {"lang": "en", "type": "finder", "value": "Leonardo Giovannini maitai"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>In OpenVSX version v0.9.0 to v0.20.0, the \n/user/namespace/{namespace}/details API allows a user to edit all \nnamespace details, even if the user is not a namespace Owner or \nContributor. The details include: name, description, website, support \nlink and social media links. The same issues existed in \n/user/namespace/{namespace}/details/logo and allowed a user to change \nthe logo.<br></div>"}], "value": "In OpenVSX version v0.9.0 to v0.20.0, the \n/user/namespace/{namespace}/details API allows a user to edit all \nnamespace details, even if the user is not a namespace Owner or \nContributor. The details include: name, description, website, support \nlink and social media links. The same issues existed in \n/user/namespace/{namespace}/details/logo and allowed a user to change \nthe logo."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "description": "CWE-285: Improper Authorization", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-283", "description": "CWE-283: Unverified Ownership", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2025-02-19T08:40:58.325Z"}, "references": [{"url": "https://github.com/eclipse/openvsx/security/advisories/GHSA-wc7c-xq2f-qp4h"}], "source": {"discovery": "EXTERNAL"}, "title": "Improper Authorization in /user/namespace/{namespace}/details", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-19T19:36:13.251919Z", "id": "CVE-2025-1007", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-19T19:36:50.732Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1007", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-19T19:36:13.251919Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-19T19:36:44.155Z"}}], "cna": {"title": "Improper Authorization in /user/namespace/{namespace}/details", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Abdel Adim smaury Oisfi of Shielder"}, {"lang": "en", "type": "finder", "value": "Andrea Cappa zi0Black of Aptos Labs"}, {"lang": "en", "type": "finder", "value": "Leonardo Giovannini maitai"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/eclipse/openvsx/", "vendor": "Eclipse Foundation", "product": "OpenVSX", "versions": [{"status": "affected", "version": "0.9.0", "versionType": "semver", "lessThanOrEqual": "0.20.0"}, {"status": "unaffected", "version": "0.19.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/eclipse/openvsx/security/advisories/GHSA-wc7c-xq2f-qp4h"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "In OpenVSX version v0.9.0 to v0.20.0, the \n/user/namespace/{namespace}/details API allows a user to edit all \nnamespace details, even if the user is not a namespace Owner or \nContributor. The details include: name, description, website, support \nlink and social media links. The same issues existed in \n/user/namespace/{namespace}/details/logo and allowed a user to change \nthe logo.", "supportingMedia": [{"type": "text/html", "value": "<div>In OpenVSX version v0.9.0 to v0.20.0, the \n/user/namespace/{namespace}/details API allows a user to edit all \nnamespace details, even if the user is not a namespace Owner or \nContributor. The details include: name, description, website, support \nlink and social media links. The same issues existed in \n/user/namespace/{namespace}/details/logo and allowed a user to change \nthe logo.<br></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285: Improper Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-283", "description": "CWE-283: Unverified Ownership"}]}], "providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2025-02-19T08:40:58.325Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1007", "state": "PUBLISHED", "dateUpdated": "2025-02-19T19:36:50.732Z", "dateReserved": "2025-02-03T22:18:13.955Z", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "datePublished": "2025-02-19T08:40:58.325Z", "assignerShortName": "eclipse"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In OpenVSX version v0.9.0 to v0.20.0, the \n/user/namespace/{namespace}/details API allows a user to edit all \nnamespace details, even if the user is not a namespace Owner or \nContributor. The details include: name, description, website, support \nlink and social media links. The same issues existed in \n/user/namespace/{namespace}/details/logo and allowed a user to change \nthe logo."}], "id": "CVE-2025-1007", "lastModified": "2025-02-19T09:15:10.117", "metrics": {"cvssMetricV40": [{"cvssData": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "automatable": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "recovery": "NOT_DEFINED", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "subsequentSystemIntegrity": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnerabilityResponseEffort": "NOT_DEFINED", "vulnerableSystemAvailability": "NONE", "vulnerableSystemConfidentiality": "NONE", "vulnerableSystemIntegrity": "LOW"}, "source": "emo@eclipse.org", "type": "Secondary"}]}, "published": "2025-02-19T09:15:10.117", "references": [{"source": "emo@eclipse.org", "url": "https://github.com/eclipse/openvsx/security/advisories/GHSA-wc7c-xq2f-qp4h"}], "sourceIdentifier": "emo@eclipse.org", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-283"}, {"lang": "en", "value": "CWE-285"}], "source": "emo@eclipse.org", "type": "Secondary"}]}