PT-2025-4032 · Embedai · Embedai

David Utón Amaya + 1 · Published 2025-01-30 · Updated 2025-01-30 · CVE-2025-0743

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions EmbedAI versions 2.1 and earlier

Description A control access issue has been identified, allowing an authenticated attacker to exploit the "/embedai/visits/show/" endpoint to obtain information about visits made by other users. The information provided by this endpoint includes the IP address, user agent, and location of the user who visited the web page. The endpoint "/embedai/visits/show/" is also vulnerable, providing similar information.

Recommendations For EmbedAI versions 2.1 and earlier, consider restricting access to the "/embedai/visits/show/" and "/embedai/visits/show/" endpoints to prevent unauthorized information disclosure. As a temporary workaround, consider disabling the visit functionality until a patch is available. Avoid using the VISIT ID parameter in the affected API endpoint until the issue is resolved.

Fix

Improper Access Control

Incorrect Authorization

Weakness Enumeration

CWE-284

CWE-863

Related Identifiers

CVE-2025-0743

Affected Products

Embedai

References · 6

• https://osv.dev/vulnerability/CVE-2025-0743 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0743 · Security Note
• https://twitter.com/VulmonFeeds/status/1884958560116732076 · Twitter Post
• https://twitter.com/CVEnew/status/1884928668377505951 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai · Note
• https://t.me/cvedetector/16759 · Telegram Post