CVE-2025-25206

HIGH

8.3

Descricao

eLabFTW is an open source electronic lab notebook for research labs. Prior to version 5.1.15, an incorrect input validation could allow an authenticated user to read sensitive information, including login token or other content stored in the database. This could lead to privilege escalation if cookies are enabled (default setting). Users must upgrade to eLabFTW version 5.1.15 to receive a fix. No known workarounds are available.

Detalhes CVE

Pontuacao CVSS v3.18.3

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado2/14/2025

Ultima modificacao8/18/2025

Fontenvd

Avistamentos honeypot0

Produtos afetados

elabftw:elabftw

Fraquezas (CWE)

CWE-89

Referencias

https://github.com/elabftw/elabftw/releases/tag/5.1.15(security-advisories@github.com)

https://github.com/elabftw/elabftw/security/advisories/GHSA-qffc-rfjh-77gg(security-advisories@github.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.