CVE-2025-31282CWE-269

A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have allowed an administrator to create users…

Medium · published April 2, 2025

CVSS v3.1
4.6
EPSS
0%
Percentile
18.2
In the wild
Unconfirmed
What it is

A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges.

Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00270 · 18.2th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2025-04-02T16:38Z
EPSS history
Timeline
  • 02 APR 16:38Z
    A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have allowed an administrator to create users…
    cvelistv5