CVE-2025-8755CWE-285CWE-639

macrozheng mall com.macro.mall.portal.controller UmsMemberController.java detail authorization

Medium · published August 9, 2025

CVSS v4.0
6.9
EPSS
1%
Percentile
45.4
In the wild
Unconfirmed
What it is

A vulnerability was found in macrozheng mall up to 1.0.3 and classified as problematic. This issue affects the function detail of the file UmsMemberController.java of the component com.macro.mall.portal.controller. The manipulation of the argument orderId leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00552 · 45.4th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-08-09T14:02Z
EPSS history
Timeline
  • 09 AUG 14:02Z
    macrozheng mall com.macro.mall.portal.controller UmsMemberController.java detail authorization
    cvelistv5