CVE-2025-2089: fallo de gravedad media en StarSea99 starsea-mall
StarSea99 starsea-mall com.siro.mall.controller.mall.UserController updateInfo updateUserInfo access control
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.5%
A vulnerability has been found in StarSea99 starsea-mall 1.0/2.X and classified as critical. Affected by this vulnerability is the function updateUserInfo of the file /personal/updateInfo of the component com.siro.mall.controller.mall.UserController. The manipulation of the argument userId leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Productos afectados
StarSea99 · starsea-mallCVEs relacionadas — StarSea99 starsea-mall
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-0399MEDIUMStarSea99 starsea-mall uploadController.java UploadController unrestricted uploadEPSS 0.4%CVE-2025-2087MEDIUMStarSea99 starsea-mall update cross site scriptingEPSS 0.4%CVE-2025-2086MEDIUMStarSea99 starsea-mall update cross site scriptingEPSS 0.4%CVE-2025-2085MEDIUMStarSea99 starsea-mall save cross site scriptingEPSS 0.3%CVE-2025-2352MEDIUMStarSea99 starsea-mall Backend save cross site scriptingEPSS 0.3%CVE-2025-0400MEDIUMStarSea99 starsea-mall update cross site scriptingEPSS 0.3%