PT-2025-10972 · Opal · Opal

Parnuski · Publicado 2025-03-11 · Atualizado 2025-03-12 · CVE-2025-27101

Positive Technologies (AI Summary)

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Opal versions prior to 5.1.1

Description: The issue affects Opal, the core database application for biobanks or epidemiological studies. When copying any parent directory to a folder in the "/temp/" directory, all files in that parent directory are copied, including files that the user should not have access to. This means any user can exploit this to reveal all files in the Opal filesystem. Low-privilege users, such as DataShield users, can retrieve the files of other users.

Recommendations: For versions prior to 5.1.1, update to version 5.1.1, which includes a patch for this issue. As a temporary workaround, consider restricting access to the "/temp/" directory to minimize the risk of exploitation. Avoid using the /temp/ directory for sensitive operations until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

AZL-62432

CVE-2025-27101

GHSA-RXMX-GQJJ-VHV8

Produtos afetados

Opal

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27101.json · Exploit
• 🔥 https://github.com/obiba/opal/security/advisories/GHSA-rxmx-gqjj-vhv8 · Exploit
• https://github.com/obiba/opal/commit/fca7dc9c8348064741b2e8b2c31b66660a935743 · Nota
• https://osv.dev/vulnerability/AZL-62432 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2025-27101 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-27101 · Nota de Segurança
• https://twitter.com/CVEnew/status/1899713909260448226 · Publicação no Twitter