PT-2025-16941 · Unknown · Continuous Compliance

CVE-2025-3113 · Published 2025-04-17 · Updated 2025-12-03

Positive Technologies (AI Summary)

CVSS v4.0

9.0

Critical

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Continuous Compliance (affected versions not specified)

Description A valid, authenticated user with sufficient privileges can leverage the application's built-in Connector functionality to access Continuous Compliance's internal database, allowing them to explore the internal database schema and export its data, including the properties of Connecters and Rule Sets.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-3113

Affected Products

Continuous Compliance

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-3113 · Security Note
• https://twitter.com/cybercronai/status/1912831092945527213 · Twitter Post
• https://twitter.com/CVEnew/status/1913455501859233881 · Twitter Post
• https://t.me/cvetracker/21844 · Telegram Post
• https://twitter.com/TweetThreatNews/status/1996065872520093965 · Twitter Post
• https://portal.perforce.com/s/detail/a91PA000001SeefYAC · Note
• https://t.me/cvedetector/23214 · Telegram Post
• https://twitter.com/transilienceai/status/1912848524359708809 · Twitter Post
• https://twitter.com/CveFindCom/status/1912763638214992177 · Twitter Post
• https://t.me/latest_high_impact_cve/2150 · Telegram Post