PT-2025-3906 · Unknown · Pmb Platform

Pau Valls Peleteiro · Published 2025-01-16 · Updated 2025-01-18 · CVE-2025-0473

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PMB Platform versions 4.0.10 and above

Description The issue exists in the file upload functionality on the /pmb/authorities/import/iimport authorities endpoint. When a file is uploaded via this resource, the server creates a temporary file that will be deleted after the client sends a POST request to /pmb/authorities/import/iimport authorities. However, an attacker can trap and launch the second POST request to prevent the temporary file from being deleted. This allows an attacker to persist temporary files on the server.

Recommendations For PMB Platform versions 4.0.10 and above, as a temporary workaround, consider restricting access to the /pmb/authorities/import/iimport authorities endpoint to minimize the risk of exploitation. Additionally, avoid using the file upload functionality until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-459

Related Identifiers

CVE-2025-0473

Affected Products

Pmb Platform

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-0473 · Security Note
• https://osv.dev/vulnerability/CVE-2025-0473 · Vendor Advisory
• https://twitter.com/WolfgangSesin/status/1879909777678999552 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-pmb-platform · Note
• https://twitter.com/CVEnew/status/1880625661402079597 · Twitter Post
• https://t.me/cvenotify/107623 · Telegram Post
• https://t.me/cvedetector/15582 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1879909771588915515 · Twitter Post