CVE-2025-10389: CRMEB Administrator Password SystemAdminServices.php save improper authorization
A security flaw has been discovered in CRMEB up to 5.6.1. Impacted is the function Save of the file app/services/system/admin/SystemAdminServices.php of the component Administrator Password Handler. Performing manipulation of the argument ID results in improper authorization. The attack may be initiated remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10389?
The severity of CVE-2025-10389 is critical due to improper authorization in the Administrator Password Handler.
How do I fix CVE-2025-10389?
To fix CVE-2025-10389, upgrade the CRMEB Administrator Password Handler to version 5.6.2 or later.
What versions of CRMEB are affected by CVE-2025-10389?
CRMEB Administrator Password Handler versions up to 5.6.1 are affected by CVE-2025-10389.
What type of vulnerability is CVE-2025-10389?
CVE-2025-10389 is an authorization vulnerability that allows manipulation of the argument ID.
Can CVE-2025-10389 lead to data breaches?
Yes, CVE-2025-10389 can potentially lead to unauthorized access and data breaches if not mitigated.