CVE-2025-41358CWE-639

CVE-2025-41358

published December 10, 2025

CVSS
8.3
EPSS
0%
Percentile
25.8
In the wild
Unconfirmed
What it is

Direct Object Reference Vulnerability (IDOR) in i2A's CronosWeb, in versions prior to 25.00.00.12, inclusive. This vulnerability could allow an authenticated attacker to access other users' documents by manipulating the ‘documentCode’ parameter in '/CronosWeb/Modulos/Personas/DocumentosPersonales/AdjuntarDocumentosPersonas'.

The record
Technical detail
CVSS
8.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00337 · 25.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-12-10T17:16Z
References (1)
https://www.incibe.es/en/incibe-cert/notices/aviso/direct-reference-insecure-objects-idor-cronosweb-cronosweb-i2a · [email protected]
EPSS history
Timeline
  • 10 DEC 11:16Z
    Direct reference to insecure objects (IDOR) in CronosWeb from CronosWeb i2A
    cvelistv5