Broken Authorization Vulnerability in Custom Web Application by Vendor X
CVE-2025-1091

4.3MEDIUM

Key Information:

Vendor

Tenable

Status
Tenable Identity Exposure
Vendor
CVE Published:
26 February 2025

What is CVE-2025-1091?

A vulnerability exists in Vendor X's Custom Web Application that stems from a broken authorization schema. If an authenticated user is aware of a specific URL, they can exploit this vulnerability to download sensitive IOA scripts and configuration files, potentially leading to unauthorized access and exposure of critical system data.

Affected Version(s)

Tenable Identity Exposure Windows 0

References

https://www.tenable.com/security/tns-2025-01

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.
The Cyber Security Vulnerability Database.