CVE-2025-25206

HIGH

8.3

Descripcion

eLabFTW is an open source electronic lab notebook for research labs. Prior to version 5.1.15, an incorrect input validation could allow an authenticated user to read sensitive information, including login token or other content stored in the database. This could lead to privilege escalation if cookies are enabled (default setting). Users must upgrade to eLabFTW version 5.1.15 to receive a fix. No known workarounds are available.

Detalles CVE

Puntuacion CVSS v3.18.3

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado2/14/2025

Ultima modificacion8/18/2025

Fuentenvd

Avistamientos honeypot0

Productos afectados

elabftw:elabftw

Debilidades (CWE)

CWE-89

Referencias

https://github.com/elabftw/elabftw/releases/tag/5.1.15(security-advisories@github.com)

https://github.com/elabftw/elabftw/security/advisories/GHSA-qffc-rfjh-77gg(security-advisories@github.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.