Vulnerability-Lookup

CVE-2025-54765 (GCVE-0-2025-54765)

Vulnerability from cvelistv5 – Published: 2025-07-28 23:25 – Updated: 2025-11-03 20:06

Title

KL-001-2025-013: Xorux XorMon-NG Web Application Privilege Escalation to Administrator

Summary

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves administrative level permissions.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-648 - Incorrect Use of Privileged APIs

Assigner

KoreLogic

References

URL

Tags

	https://korelogic.com/Resources/Advisories/KL-001…	third-party-advisory
	https://xormon.com/note190.php	release-notes

Impacted products

	Vendor	Product	Version
	Xorux	XorMon-NG	Affected: 1.8 , < 1.9.38 (semver)

Credits

This vulnerability was discovered by Jim Becher of KoreLogic, Inc.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-54765",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-29T13:29:39.349749Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-29T13:30:23.481Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:06:32.315Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2025/Jul/16"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "Linux"
          ],
          "product": "XorMon-NG",
          "vendor": "Xorux",
          "versions": [
            {
              "lessThan": "1.9.38",
              "status": "affected",
              "version": "1.8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This vulnerability was discovered by Jim Becher of KoreLogic, Inc."
        }
      ],
      "datePublic": "2025-07-28T23:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves administrative level permissions."
            }
          ],
          "value": "An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves administrative level permissions."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-648",
              "description": "CWE-648: Incorrect Use of Privileged APIs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-28T23:25:12.409Z",
        "orgId": "bbf0bd87-ece2-41be-b873-96928ee8fab9",
        "shortName": "KoreLogic"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://korelogic.com/Resources/Advisories/KL-001-2025-013.txt"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://xormon.com/note190.php"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "KL-001-2025-013: Xorux XorMon-NG Web Application Privilege Escalation to Administrator",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bbf0bd87-ece2-41be-b873-96928ee8fab9",
    "assignerShortName": "KoreLogic",
    "cveId": "CVE-2025-54765",
    "datePublished": "2025-07-28T23:25:12.409Z",
    "dateReserved": "2025-07-28T16:02:18.185Z",
    "dateUpdated": "2025-11-03T20:06:32.315Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://seclists.org/fulldisclosure/2025/Jul/16\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:06:32.315Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-54765\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-07-29T13:29:39.349749Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-07-29T13:30:16.029Z\"}}], \"cna\": {\"title\": \"KL-001-2025-013: Xorux XorMon-NG Web Application Privilege Escalation to Administrator\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"This vulnerability was discovered by Jim Becher of KoreLogic, Inc.\"}], \"affected\": [{\"vendor\": \"Xorux\", \"product\": \"XorMon-NG\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.8\", \"lessThan\": \"1.9.38\", \"versionType\": \"semver\"}], \"platforms\": [\"Linux\"], \"defaultStatus\": \"affected\"}], \"datePublic\": \"2025-07-28T23:00:00.000Z\", \"references\": [{\"url\": \"https://korelogic.com/Resources/Advisories/KL-001-2025-013.txt\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://xormon.com/note190.php\", \"tags\": [\"release-notes\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves administrative level permissions.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves administrative level permissions.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-648\", \"description\": \"CWE-648: Incorrect Use of Privileged APIs\"}]}], \"providerMetadata\": {\"orgId\": \"bbf0bd87-ece2-41be-b873-96928ee8fab9\", \"shortName\": \"KoreLogic\", \"dateUpdated\": \"2025-07-28T23:25:12.409Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-54765\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T20:06:32.315Z\", \"dateReserved\": \"2025-07-28T16:02:18.185Z\", \"assignerOrgId\": \"bbf0bd87-ece2-41be-b873-96928ee8fab9\", \"datePublished\": \"2025-07-28T23:25:12.409Z\", \"assignerShortName\": \"KoreLogic\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2025-54765

Vulnerability from fkie_nvd - Published: 2025-07-29 00:15 - Updated: 2025-11-03 20:19

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

References

URL	Tags
bbf0bd87-ece2-41be-b873-96928ee8fab9	https://korelogic.com/Resources/Advisories/KL-001-2025-013.txt	Exploit, Third Party Advisory
bbf0bd87-ece2-41be-b873-96928ee8fab9	https://xormon.com/note190.php	Release Notes
af854a3a-2127-422b-91ae-364da2661108	http://seclists.org/fulldisclosure/2025/Jul/16

Impacted products

	Vendor	Product	Version
	xorux	xormon	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:xorux:xormon:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F4F70782-50E5-494E-BE2B-36E054D0A9D2",
              "versionEndIncluding": "1.8.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves administrative level permissions."
    },
    {
      "lang": "es",
      "value": "Un endpoint de API, que deber\u00eda estar limitado a los administradores de aplicaciones web, est\u00e1 oculto, pero es accesible para usuarios de aplicaciones web de solo lectura de nivel inferior. Este endpoint puede usarse para importar la configuraci\u00f3n del dispositivo, lo que permite a un atacante controlar la configuraci\u00f3n del dispositivo, incluyendo la concesi\u00f3n de permisos de nivel administrativo."
    }
  ],
  "id": "CVE-2025-54765",
  "lastModified": "2025-11-03T20:19:14.530",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-07-29T00:15:23.737",
  "references": [
    {
      "source": "bbf0bd87-ece2-41be-b873-96928ee8fab9",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://korelogic.com/Resources/Advisories/KL-001-2025-013.txt"
    },
    {
      "source": "bbf0bd87-ece2-41be-b873-96928ee8fab9",
      "tags": [
        "Release Notes"
      ],
      "url": "https://xormon.com/note190.php"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://seclists.org/fulldisclosure/2025/Jul/16"
    }
  ],
  "sourceIdentifier": "bbf0bd87-ece2-41be-b873-96928ee8fab9",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-648"
        }
      ],
      "source": "bbf0bd87-ece2-41be-b873-96928ee8fab9",
      "type": "Secondary"
    }
  ]
}

GHSA-6RGX-J4WH-77C4

Vulnerability from github – Published: 2025-07-29 00:30 – Updated: 2025-11-03 21:34

Details

Severity ?

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-54765"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-648"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-29T00:15:23Z",
    "severity": "MODERATE"
  },
  "details": "An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves administrative level permissions.",
  "id": "GHSA-6rgx-j4wh-77c4",
  "modified": "2025-11-03T21:34:11Z",
  "published": "2025-07-29T00:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54765"
    },
    {
      "type": "WEB",
      "url": "https://korelogic.com/Resources/Advisories/KL-001-2025-013.txt"
    },
    {
      "type": "WEB",
      "url": "https://xormon.com/note190.php"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2025/Jul/16"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-54765 (GCVE-0-2025-54765)

FKIE_CVE-2025-54765

GHSA-6RGX-J4WH-77C4

Tags

Sightings

Nomenclature