CVE-2025-1007CWE-283CWE-285

Improper Authorization in /user/namespace/{namespace}/details

Medium · published February 19, 2025

CVSS v4.0
6.9
EPSS
1%
Percentile
42.8
In the wild
Unconfirmed
What it is

In OpenVSX version v0.9.0 to v0.20.0, the

/user/namespace/{namespace}/details API allows a user to edit all

namespace details, even if the user is not a namespace Owner or

Contributor. The details include: name, description, website, support

link and social media links. The same issues existed in

/user/namespace/{namespace}/details/logo and allowed a user to change

the logo.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00517 · 42.8th percentile
Weaknesses
CWE-283 · Unverified Ownership; CWE-285 · Improper Authorization
Published
2025-02-19T08:40Z
EPSS history
Timeline
  • 19 FEB 08:40Z
    Improper Authorization in /user/namespace/{namespace}/details
    cvelistv5