Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2025-3014
PUBLISHED
More InfoOfficial Page
Assigner-FSOFT
Assigner Org ID-5ac195ad-69e7-48e7-9c1e-bfc958c39761
View Known Exploited Vulnerability (KEV) details
Published At-31 Mar, 2025 | 03:48
Updated At-31 Mar, 2025 | 13:37
Rejected At-
▼CVE Numbering Authority (CNA)
Insecure direct object references (IDOR) in NightWolf Penetration Platform

Insecure Direct Object References (IDOR) in access control in Tracking 2.1.4 on NightWolf Penetration Testing allows an attacker to access via manipulating request parameters or object references.

Affected Products
Vendor
FPT Software
Product
NightWolf Penetration Platform
Modules
  • tracking
Default Status
unaffected
Versions
Affected
  • 2.1.4 (custom)
Unaffected
  • 2.1.5 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-285CWE-285: Improper Authorization
Type: CWE
CWE ID: CWE-285
Description: CWE-285: Improper Authorization
Metrics
VersionBase scoreBase severityVector
4.08.3HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Version: 4.0
Base score: 8.3
Base severity: HIGH
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-27CAPEC-27: Leveraging Trust in Client
CAPEC ID: CAPEC-27
Description: CAPEC-27: Leveraging Trust in Client
Solutions
Configurations
Workarounds
Exploits
Credits
reporter
Hoang Anh Khoa (khoahoang329@gmail.com)
finder
Quyen Hong Son (sonqh.kma@gmail.com)
Timeline
EventDate
The reporter submits the vulnerability to security_report@fpt.com.2025-03-28 10:00:00
The security team verifies the issue and provides a fixing solution.2025-03-29 02:00:00
The security team releases the fix, retests the issue, and closes the vulnerability.2025-03-30 10:00:00
Assign a CVE to the reporter.2025-03-31 02:00:00
Event: The reporter submits the vulnerability to security_report@fpt.com.
Date: 2025-03-28 10:00:00
Event: The security team verifies the issue and provides a fixing solution.
Date: 2025-03-29 02:00:00
Event: The security team releases the fix, retests the issue, and closes the vulnerability.
Date: 2025-03-30 10:00:00
Event: Assign a CVE to the reporter.
Date: 2025-03-31 02:00:00
Replaced By
Rejected Reason
References
HyperlinkResource
https://bug.report.night-wolf.io/changelogs
N/A
Hyperlink: https://bug.report.night-wolf.io/changelogs
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Details not found