PT-2025-48486 · Data Illusion · Zumbrunn Ngsurvey

Thomas Clair · Publicado 2025-12-01 · Atualizado 2025-12-01 · CVE-2025-13829

Positive Technologies (AI Summary)

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:Y

Name of the Vulnerable Software and Affected Versions Data Illusion Zumbrunn NGSurvey (affected versions not specified)

Description An incorrect authorization issue exists in Data Illusion Zumbrunn NGSurvey, allowing any authenticated user to access the private information of other users. This includes sensitive data such as the APIKEY (valid for a one-year user session), RefreshToken (valid for a ten-minute user session), Password hashed with bcrypt, User IP, Email, and Full Name. The issue involves unauthorized access to user data through improper authorization checks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2025-13829

Produtos afetados

Zumbrunn Ngsurvey

Referências · 4

• https://twitter.com/VulmonFeeds/status/1995604512455655758 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-13829 · Nota de Segurança
• https://twitter.com/CVEnew/status/1995522255334564025 · Publicação no Twitter
• https://docs.ngsurvey.com/installation-setup/change-log#id-3.6.17-2025-05-28 · Aviso do Fabricante