« Volver al listado

CVE-2025-14881

Estado: AplazadaBaja (3.8)—

Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-14881",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-14881",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-12-19T12:58:00.895498Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 3.8,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "UNREPORTED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6",
      "affectedData": [
        {
          "repo": "https://github.com/pretix/pretix",
          "vendor": "pretix",
          "product": "pretix",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "2025.8.0",
              "versionType": "python"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "2025.8.3",
                  "status": "unaffected"
                }
              ],
              "version": "2025.8.0",
              "lessThan": "2025.9.0",
              "versionType": "python"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "2025.9.3",
                  "status": "unaffected"
                }
              ],
              "version": "2025.9.0",
              "lessThan": "2025.10.0",
              "versionType": "python"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "2025.10.1",
                  "status": "unaffected"
                }
              ],
              "version": "2025.10.0",
              "lessThan": "2025.11.0",
              "versionType": "python"
            }
          ],
          "packageName": "pretix",
          "collectionURL": "https://pypi.org/",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-12-19T13:16:01.467",
  "references": [
    {
      "url": "https://pretix.eu/about/en/blog/20251218-release-2025-10-1/",
      "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only."
    }
  ],
  "lastModified": "2026-06-17T08:36:42.263",
  "sourceIdentifier": "655498c3-6ec5-4f0b-aea6-853b334d05a6"
}