PT-2025-17616 · Unknown · Meon Bidding Solutions

Published 2025-04-23 · Updated 2025-04-23 · CVE-2025-42605

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Meon Bidding Solutions (affected versions not specified)

Description This issue exists due to improper authorization controls on certain API endpoints for the initiation, modification, or cancellation operations. An authenticated remote attacker could exploit this by manipulating parameters in the API request body to gain unauthorized access to other user accounts. Successful exploitation could allow a remote attacker to perform authorized manipulation of data associated with other user accounts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BDU:2025-16491

CVE-2025-42605

Affected Products

Meon Bidding Solutions

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-42605 · Security Note
• https://bdu.fstec.ru/vul/2025-16491 · Security Note
• https://twitter.com/CveFindCom/status/1914998304041021836 · Twitter Post
• https://t.me/cvetracker/22196 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1915028240764223533 · Twitter Post
• https://twitter.com/cybercronai/status/1915069554151039409 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1915018487858180465 · Twitter Post
• https://t.me/cvedetector/23584 · Telegram Post
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0082 · Note
• https://twitter.com/CVEnew/status/1915001184579895363 · Twitter Post
• https://twitter.com/Carlos_LopezMkt/status/1915000433828864030 · Twitter Post