PT-2025-12306 · Aimhubio · Aim

Published 2025-03-20 · Updated 2025-03-28 · CVE-2025-0190

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions aimhubio/aim version 3.25.0

Description A denial of service issue exists, where tracking a large number of Text objects and then querying them simultaneously through the web API can cause the Aim web server to become unresponsive to other requests for an extended period. This can be exploited repeatedly, leading to a complete denial of service.

Recommendations For version 3.25.0, consider restricting access to the web API or limiting the number of Text objects that can be queried simultaneously to minimize the risk of exploitation. As a temporary workaround, consider implementing rate limiting or IP blocking to prevent repeated exploitation.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1049

Related Identifiers

CVE-2025-0190

GHSA-FM93-G6XP-35XQ

Affected Products

Aim

References · 9

• 🔥 https://huntr.com/bounties/38d151f1-abb4-443a-86b0-6c26f0c6cb70 · Exploit
• https://osv.dev/vulnerability/GHSA-fm93-g6xp-35xq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0190 · Security Note
• https://osv.dev/vulnerability/CVE-2025-0190 · Vendor Advisory
• https://github.com/aimhubio/aim · Note
• https://t.me/latest_high_impact_cve/2010 · Telegram Post
• https://twitter.com/CVEnew/status/1903336852020461855 · Twitter Post
• https://twitter.com/dailycve/status/1905642616441479664 · Twitter Post
• https://t.me/cvetracker/19511 · Telegram Post