PT-2025-7484 · Openvsx · Openvsx

Maitaii + 2 · Published 2025-02-19 · Updated 2025-07-31 · CVE-2025-1007

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenVSX versions v0.9.0 through v0.20.0

Description The issue allows a user to edit all namespace details, including name, description, website, support link, and social media links, even if the user is not a namespace Owner or Contributor. This is possible through the /user/namespace/{namespace}/details API endpoint and also affects the /user/namespace/{namespace}/details/logo endpoint, allowing a user to change the logo.

Recommendations For OpenVSX versions v0.9.0 through v0.20.0, consider restricting access to the /user/namespace/{namespace}/details and /user/namespace/{namespace}/details/logo API endpoints to only allow authorized users, such as namespace Owners or Contributors, to edit namespace details and change logos. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

CWE-283

Related Identifiers

CVE-2025-1007

GHSA-WC7C-XQ2F-QP4H

Affected Products

Openvsx

References · 8

• https://github.com/eclipse/openvsx/security/advisories/GHSA-wc7c-xq2f-qp4h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-1007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1007 · Security Note
• https://t.me/cveNotify/130377 · Telegram Post
• https://t.me/cvenotify/111747 · Telegram Post
• https://t.me/cvedetector/18413 · Telegram Post
• https://twitter.com/CVEnew/status/1892140873833681155 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1892177168873959511 · Twitter Post