Karl.Fail

Tag: cwe-288

  • CVE-2025-0159: Authentication Bypass in IBM FlashSystem (Storage Virtualize)

    Overview

    IBM has disclosed a critical vulnerability, CVE-2025-0159, affecting multiple versions of its FlashSystem product line through the IBM Storage Virtualize platform. This flaw is categorized under CWE-288: Authentication Bypass Using an Alternate Path or Channel and enables unauthenticated attackers to bypass authentication controls at the RPCAdapter endpoint.

    Vulnerability Details

    The issue lies in the handling of HTTP requests at the RPCAdapter endpoint. By sending a specially crafted HTTP request, a remote attacker can bypass authentication mechanisms entirely. This allows unauthorized access to sensitive administrative functions or data without requiring user credentials or prior access.

    The vulnerability impacts multiple versions from the 8.5.0.0 release through 8.7.2.1, including several patch levels across versions 8.5, 8.6, and 8.7. This wide range of affected versions underscores the urgency for enterprise customers using IBM FlashSystem to apply mitigations immediately.

    Technical Breakdown

    According to IBM and CVSS v3.1, the vulnerability is rated as Critical with a base score of 9.1. The CVSS vector is:

    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

    Key characteristics:

    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

    Impacted Products

    The vulnerability affects the following IBM Storage Virtualize versions:

    • 8.5.0.0 – 8.5.0.13
    • 8.5.1.0
    • 8.5.2.0 – 8.5.2.3
    • 8.5.3.0 – 8.5.3.1
    • 8.5.4.0
    • 8.6.0.0 – 8.6.0.5
    • 8.6.1.0
    • 8.6.2.0 – 8.6.2.1
    • 8.6.3.0
    • 8.7.0.0 – 8.7.0.2
    • 8.7.1.0
    • 8.7.2.0 – 8.7.2.1

    Mitigation and Recommendations

    • IBM strongly recommends upgrading to the latest version of IBM Storage Virtualize that addresses this vulnerability.
    • Restrict network access to affected systems and RPCAdapter endpoints wherever possible.
    • Monitor for unauthorized access attempts or suspicious RPC traffic.

    Conclusion

    CVE-2025-0159 represents a serious security risk for enterprises using IBM FlashSystem solutions. Its network-based, unauthenticated nature means attackers can remotely compromise systems without prior access. Prompt action is essential to protect sensitive storage infrastructure from exploitation.

    For more information, consult IBM’s official security advisory.

  • Critical Authentication Bypass in BuddyBoss Platform Pro (CVE-2025-1909)

    Overview

    A critical vulnerability has been discovered in the BuddyBoss Platform Pro plugin for WordPress, affecting all versions up to and including 2.7.01. This flaw, tracked as CVE-2025-1909, allows unauthenticated attackers to bypass authentication and log in as any existing user, including administrators, via the Apple OAuth provider.

    Technical Details

    The vulnerability arises due to insufficient verification of the user identity during the Apple OAuth authentication process. When a login request is made through this provider, the plugin fails to properly confirm the authenticity of the user information. This oversight enables attackers who know the email address of an existing user to craft a malicious request and gain unauthorized access.

    This issue is categorized under CWE-288: Authentication Bypass Using an Alternate Path or Channel.

    CVSS and Severity

    According to the Common Vulnerability Scoring System (CVSS) v3.1, this vulnerability has a base score of 9.8, making it Critical in severity. The vector string is:

    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

    This indicates that:

    • The attack is network-based
    • No privileges are required
    • No user interaction is needed
    • Impact is high on confidentiality, integrity, and availability

    Impact

    Successful exploitation means attackers can impersonate site users, including administrators, leading to complete control over the WordPress site. This includes access to sensitive data, ability to install malicious plugins or themes, and potential full site compromise.

    Mitigation

    Site administrators are urged to update BuddyBoss Platform Pro to the latest available version immediately. As of the publication date, version 2.7.10 includes the necessary fix.

    If updating is not immediately possible, consider temporarily disabling Apple OAuth login functionality until the update can be applied.

    Discovery and Disclosure

    This vulnerability was discovered by István Márton and responsibly disclosed to the vendor on March 3, 2025. The issue was publicly disclosed on May 5, 2025. For more technical information, see the Wordfence advisory.

    Conclusion

    CVE-2025-1909 highlights the importance of rigorous identity validation in third-party authentication mechanisms. Website owners using BuddyBoss Platform Pro should take immediate action to mitigate potential exploitation and protect user accounts from unauthorized access.

  • CVE-2025-1315: Critical Privilege Escalation via Password Reset in InWave Jobs WordPress Plugin

    Overview

    CVE-2025-1315 is a critical vulnerability in the InWave Jobs plugin for WordPress, affecting all versions up to and including 3.5.1. This flaw allows unauthenticated attackers to reset the password of any user, including administrators, leading to full compromise of affected WordPress sites.

    Technical Details

    The vulnerability arises from the plugin’s failure to properly validate the identity of the user initiating a password reset. As a result, an attacker can craft a request that changes the password of any account without authentication. This type of flaw is categorized under CWE-288: Authentication Bypass Using an Alternate Path or Channel.

    Once the password of a privileged user, such as an administrator, is changed, the attacker gains full access to the backend, allowing them to:

    • Modify or delete content
    • Install malicious plugins or themes
    • Exfiltrate sensitive data
    • Compromise other user accounts

    CVSS Score

    This vulnerability has been assigned a CVSS v3.1 score of 9.8 (Critical):

    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
    • Impact: High for Confidentiality, Integrity, and Availability

    Impacted Versions

    All versions of the InWave Jobs plugin up to and including 3.5.1 are affected. This includes installations integrated with themes like InJob.

    Mitigation

    • Immediately update to a patched version if available.
    • Disable the plugin temporarily if an update is not available.
    • Review your site’s user accounts for unauthorized changes or suspicious activity.
    • Reset administrator passwords after patching to ensure security.

    Conclusion

    This vulnerability emphasizes the importance of strict identity validation for all user-sensitive actions, especially password resets. A missing check in such a critical function can open the door to full system compromise. Site administrators using InWave Jobs should patch immediately and audit their sites for signs of intrusion.

    Credit for discovery goes to Tonn. For more information, visit the Wordfence advisory.

  • CVE-2025-1061: Critical Authentication Bypass in Nextend Social Login Pro via Apple OAuth

    Overview

    CVE-2025-1061 is a critical authentication bypass vulnerability in the Nextend Social Login Pro plugin for WordPress. Versions up to and including 3.1.16 are affected. The flaw allows unauthenticated attackers to log in as any existing user, including administrators, by exploiting weaknesses in the Apple OAuth authentication process.

    Technical Details

    The vulnerability stems from insufficient verification of the user data provided during the Apple OAuth authentication request. Specifically, the plugin fails to securely validate the identity of the user returned by Apple, enabling attackers who know or can guess an existing user’s email address to log in without needing their password or valid credentials.

    This issue is classified under CWE-288: Authentication Bypass Using an Alternate Path or Channel. By bypassing the standard login mechanisms, an attacker can impersonate site administrators or other privileged users, gaining full access to the WordPress dashboard and potentially compromising the entire website.

    CVSS Score

    The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (Critical), indicating the highest level of severity:

    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
    • Impact: High (Confidentiality, Integrity, Availability)

    Impacted Versions

    All versions of Nextend Social Login Pro up to and including 3.1.16 are affected. Site owners using this plugin should check their version immediately.

    Mitigation

    • Update to the latest version of the plugin that contains a patch for this issue.
    • Audit user access and check for signs of unauthorized logins, especially for administrator accounts.
    • Reconfigure or disable Apple OAuth login until you are certain the patch is in place and effective.

    Conclusion

    OAuth integrations simplify user login but must be handled with strict validation and security checks. This incident underscores the importance of never trusting identity assertions without verification. Plugin developers and site administrators alike should take extra precautions with third-party login providers.

    For more details, consult the official advisory on Wordfence or view the plugin documentation on Nextend.