← CVE Intelligence

CVE-2025-41358

Direct reference to insecure objects (IDOR) in CronosWeb from CronosWeb i2A PUBLISHED

Description (CNA)

Direct Object Reference Vulnerability (IDOR) in i2A's CronosWeb, in versions prior to 25.00.00.12, inclusive. This vulnerability could allow an authenticated attacker to access other users' documents by manipulating the ‘documentCode’ parameter in '/CronosWeb/Modulos/Personas/DocumentosPersonales/AdjuntarDocumentosPersonas'.

Affected (CNA)

Vendor / productVersions
CronosWeb i2A / CronosWebaffected 25.00 and 24.05.

CWE

CWE-639

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.