CVE-2025-1501: Incorrect authorization for traces request/download in CMC before 25.1.0
An access control vulnerability was discovered in the Request Trace and Download Trace functionalities of CMC before 25.1.0 due to a specific access restriction not being properly enforced for users with limited privileges. An authenticated user with limited privileges can request and download trace files due to improper access restrictions, potentially exposing unauthorized network data.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1501?
CVE-2025-1501 is classified as a high severity access control vulnerability.
How do I fix CVE-2025-1501?
To fix CVE-2025-1501, upgrade the CMC software to version 25.1.0 or later.
Who is affected by CVE-2025-1501?
CVE-2025-1501 affects users of CMC versions prior to 25.1.0.
What functionalities are impacted by CVE-2025-1501?
CVE-2025-1501 impacts the Request Trace and Download Trace functionalities due to improper access restrictions.
Can an unauthenticated user exploit CVE-2025-1501?
An unauthenticated user cannot exploit CVE-2025-1501; only authenticated users with limited privileges are affected.