PT-2025-21276 · Esignal · Esignal

Pablo Alcarria · Published 2025-05-15 · Updated 2025-05-15 · CVE-2025-4762

Positive Technologies (AI Summary)

CVSS v4.0

2.0

Low

Base vector

AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: eSigna versions 1.0 through 1.5

Description: The issue is related to an Insecure Direct Object Reference (IDOR) vulnerability in the eSignaViewer component. This vulnerability allows an unauthenticated attacker to access arbitrary files in the document system by manipulating file paths and object identifiers.

Recommendations: For eSigna versions 1.0 through 1.5, consider restricting access to the eSignaViewer component until a patch is available. As a temporary workaround, limit the manipulation of file paths and object identifiers to prevent unauthorized access to the document system.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-4762

Affected Products

Esignal

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-4762 · Security Note
• https://t.me/cvenotify/122289 · Telegram Post
• https://edgewatch.com/vulnerability-advisories/path-traversal-and-idor-vulnerabilities-in-esignaviewer-allow-unauthorized-file-access · Note
• https://twitter.com/CVEnew/status/1922992674870620336 · Twitter Post
• https://t.me/cvetracker/23901 · Telegram Post