PT-2025-16017 · W. W. Norton · W. W. Norton Inquizitive

Jit_Shellcode · Published 2025-04-11 · Updated 2025-04-16 · CVE-2025-32808

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: W. W. Norton InQuizitive versions through 2025-04-08

Description: The issue allows students to insert arbitrary records of their quiz performance into the backend due to the existence of only client-side access control. This is related to a client-side enforcement of server-side security, specifically CWE-602.

Recommendations: For W. W. Norton InQuizitive versions through 2025-04-08, consider disabling the functionality that allows students to insert records of their quiz performance into the backend until a patch is available. Restrict access to the backend to minimize the risk of exploitation. Avoid using the affected functionality in the API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-602

Related Identifiers

CVE-2025-32808

Affected Products

W. W. Norton Inquizitive

References · 8

• 🔥 https://medium.com/@JIT_Shellcode/inquizitive-client-side-injection-lms-trust-bypass-and-stored-xss-0ea4da8d22fa · Exploit
• https://osv.dev/vulnerability/CVE-2025-32808 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32808 · Security Note
• https://t.me/latest_high_impact_cve/2125 · Telegram Post
• https://twitter.com/cracbot/status/1912461024512389604 · Twitter Post
• https://t.me/cvedetector/22701 · Telegram Post
• https://t.me/cvenotify/118785 · Telegram Post
• https://twitter.com/cybercronai/status/1911015278680351156 · Twitter Post