PT-2025-43974 · Hubspot · Hubspot

CVE-2023-37749 · Publicado 2025-10-27 · Atualizado 2025-10-27

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions HubSpot version 1.29441

Description An issue exists in the REST API endpoint of HubSpot that allows unauthenticated attackers to view users' data without proper authorization due to incorrect access control. The API endpoint ''/api/v1/users'' is vulnerable. The vulnerable parameter is user id.

Recommendations Apply updated access controls to the REST API endpoint to ensure proper authentication and authorization mechanisms are in place. Restrict access to the API endpoint ''/api/v1/users'' to authenticated users only.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2023-37749

Produtos afetados

Hubspot

Referências · 6

• https://t.me/CVEtracker/35847 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1982837421608727039 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-37749 · Nota de Segurança
• https://gist.github.com/0xDBJ/28072f7eea42571d5b4ebaabdcb21cce · Nota
• https://owasp.org/Top10/A01_2021-Broken_Access_Control · Nota
• https://app.hubspot.com/api/external-options/v2/pagedFetch/0-1/OWNER?useIndexOffset=true&portalId=22152277&clienttimeout=14000&hs_static_app=settings-ui-users&hs_static_app_version=1.43001&limit=200&q=&offset=0&includeDeleted=true · Nota