« Volver al listado

CVE-2025-67505

Estado: AnalizadaAlta (8.4)—

Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso a red remota (AV:N) con privilegios requeridos (PR:L) en SDK expuesto; race condition permite lectura de respuestas ajenas (C:H) y manipulación de datos entre requests (I:H), comprometiendo autenticación y integridad.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementActive Directory ConfigurationVulnerability ScanningUser TrainingUser Account ManagementThreat Intelligence Program

Tecnologías afectadas (1)

Okta — Java Management SDK

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-67505",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-67505",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-12-11T15:37:59.171457Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.4,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "okta",
          "product": "okta-sdk-java",
          "versions": [
            {
              "status": "affected",
              "version": ">= 11.0.0, < 20.0.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-12-10T23:15:48.667",
  "references": [
    {
      "url": "https://github.com/okta/okta-sdk-java/commit/abf4f128a0441f90cb7efcdcf4bde1aef8703243",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/okta/okta-sdk-java/security/advisories/GHSA-j5gq-897m-2rff",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1."
    },
    {
      "lang": "es",
      "value": "El SDK de gestión de Java de Okta facilita las interacciones con la API de gestión de Okta. En las versiones 11.0.0 a 20.0.0, pueden surgir condiciones de carrera a partir de solicitudes concurrentes que utilizan la clase ApiClient. Esto podría provocar que un código de estado o una cabecera de respuesta de la respuesta de una solicitud influya en la respuesta de otra solicitud. Este problema se ha corregido en la versión 20.0.1."
    }
  ],
  "lastModified": "2026-09-25T23:10:00.463",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:okta:java_management_sdk:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62438062-BAC8-4B6C-8940-244143824FA0",
              "versionEndExcluding": "20.0.1",
              "versionStartIncluding": "11.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}