Insecure Direct Object Reference in Control iD RH PDF Document Handler
CVE-2025-2125

5.3MEDIUM

Key Information:

Vendor

Control Id

Status
Rh Id
Vendor
CVE Published:
9 March 2025

What is CVE-2025-2125?

A vulnerability exists in the PDF Document Handler of Control iD RH iD version 25.2.25.0, which allows an attacker to manipulate the 'nsr' argument in the endpoint /v2/report.svc/comprovante_marcacao/?companyId=1. This manipulation can lead to improper control of resource identifiers, potentially exposing sensitive information or allowing unauthorized access. The vulnerability can be exploited remotely, posing significant risks to affected systems. Despite early disclosure attempts, the vendor has not responded.

Affected Version(s)

RH iD 25.2.25.0

References

https://vuldb.com/?id.299038
vdb-entrytechnical-description
https://vuldb.com/?ctiid.299038
signaturepermissions-required
https://vuldb.com/?submit.509856
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

y4g0 (VulDB User)
.