PT-2025-5596 · Rengine · Rengine

Raditzz0 · Published 2025-02-01 · Updated 2025-05-13 · CVE-2025-24899

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: reNgine versions prior to 2.2.0

Description: A vulnerability was discovered in reNgine, where an insider attacker with any role can extract sensitive information from other reNgine users. After running a scan and obtaining vulnerabilities from a target, the attacker can retrieve details such as username, password, email, role, first name, last name, status, and activity information by making a GET request to "/api/listVulnerability/".

Recommendations: For versions prior to 2.2.0, update to version 2.2.0 to resolve the issue. As a temporary workaround, consider restricting access to the "/api/listVulnerability/" endpoint until the update is applied. Avoid using sensitive information in the affected API endpoint until the issue is resolved.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2025-06046

CVE-2025-24899

GHSA-R3FP-XR9F-WV38

Affected Products

Rengine

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24899.json · Exploit
• https://github.com/yogeshojha/rengine/security/advisories/GHSA-r3fp-xr9f-wv38 · Vendor Advisory
• https://github.com/yogeshojha/rengine/commit/a658b8519f1a3347634b04733cf91ed933af1f99 · Patch
• https://osv.dev/vulnerability/CVE-2025-24899 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06046 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-24899 · Security Note
• https://twitter.com/dailycve/status/1922408743024615894 · Twitter Post
• https://twitter.com/CVEnew/status/1886523325696106608 · Twitter Post
• https://t.me/cvedetector/17137 · Telegram Post
• https://t.me/cvenotify/122031 · Telegram Post
• https://vulners.com/cve/CVE-2025-24899 · Note