PT-2025-49550 · Unknown · Vulnerability-Lookup

Published 2025-12-08 · Updated 2025-12-08 · CVE-2025-42616

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vulnerability-Lookup versions prior to 2.18.0

Description Certain endpoints in Vulnerability-Lookup allowed modification of application state—including database entries, user data, and configurations—through HTTP GET requests without Cross-Site Request Forgery (CSRF) token validation. This creates a risk of Cross-Site Request Forgery (CSRF) attacks, where a malicious website could trick a logged-in user into unintentionally performing state-changing operations. An attacker could exploit this to escalate privileges or alter settings without the user's knowledge. The issue was addressed by requiring HTTP POST requests and valid CSRF tokens for all state-changing endpoints, preventing unauthorized state modifications via GET requests.

Recommendations Versions prior to 2.18.0 should be updated to version 2.18.0 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-42616

Affected Products

Vulnerability-Lookup

References · 3

• https://vulnerability.circl.lu/vuln/gcve-1-2025-0034 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-42616 · Security Note
• https://t.me/CVEtracker/39120 · Telegram Post