« Volver al listado

CVE-2025-41458

Estado: AplazadaMedia (5.5)—

Unencrypted storage in the database in Two App Studio Journey v5.5.9 for iOS allows local attackers to extract sensitive data via direct access to the app’s filesystem.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

TWO APP Studio — JourneyAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-41458",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-41458",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-21T12:28:16.325042Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "a341c0d1-ebf7-493f-a84e-38cf86618674",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "a341c0d1-ebf7-493f-a84e-38cf86618674",
      "affectedData": [
        {
          "vendor": "Two App Studio",
          "product": "Journey",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "5.5.9"
            }
          ],
          "platforms": [
            "iOS"
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2025-07-21T11:15:23.640",
  "references": [
    {
      "url": "https://www.cirosec.de/sa/sa-2025-005",
      "source": "a341c0d1-ebf7-493f-a84e-38cf86618674"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "a341c0d1-ebf7-493f-a84e-38cf86618674",
      "description": [
        {
          "lang": "en",
          "value": "CWE-312"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unencrypted storage in the database in Two App Studio Journey v5.5.9 for iOS allows local attackers to extract sensitive data via direct access to the app’s filesystem."
    },
    {
      "lang": "es",
      "value": "El almacenamiento sin cifrar en la base de datos en Two App Studio Journey v5.5.9 para iOS permite a atacantes locales extraer datos confidenciales mediante acceso directo al sistema de archivos de la aplicación."
    }
  ],
  "lastModified": "2026-06-17T09:22:53.150",
  "sourceIdentifier": "a341c0d1-ebf7-493f-a84e-38cf86618674"
}