PT-2025-6886 · Kong · Kong Insomnia

Fergod · Published 2025-02-16 · Updated 2025-02-16 · CVE-2025-1353

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Kong Insomnia versions prior to 10.3.0

Description: A critical issue has been detected in Kong Insomnia, affecting some unknown processing in the library profapi.dll. The manipulation leads to an untrusted search path. An attack must be approached locally and has a rather high complexity. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.

Recommendations: For versions prior to 10.3.0, consider restricting access to the library profapi.dll to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using any functions that may lead to an untrusted search path in the affected library. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2025-1353

Affected Products

Kong Insomnia

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-1353 · Security Note
• https://vuldb.com/?ctiid.295961 · Note
• https://vuldb.com/?id.295961 · Note
• https://t.me/cvenotify/111518 · Telegram Post
• https://twitter.com/CVEnew/status/1891143741399765200 · Twitter Post
• https://t.me/latest_high_impact_cve/1838 · Telegram Post
• https://vuldb.com/?submit.496010 · Note
• https://t.me/cvedetector/18186 · Telegram Post