CVE-2025-60982

{
  "id": "CVE-2025-60982",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-27T18:15:43.420",
  "lastModified": "2026-11-05T21:10:00.183",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IDOR vulnerability in Educare ERP 1.0 (2025-04-22) allows unauthorized access to sensitive data via manipulated object references. Affected endpoints do not enforce proper authorization checks, allowing authenticated users to access or modify data belonging to other users by changing object identifiers in API requests. Attackers can exploit this flaw to view or modify sensitive records without proper authorization."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad IDOR en Educare ERP 1.0 (2025-04-22) permite el acceso no autorizado a datos sensibles a través de referencias de objetos manipuladas. Los endpoints afectados no aplican comprobaciones de autorización adecuadas, permitiendo a los usuarios autenticados acceder o modificar datos pertenecientes a otros usuarios cambiando los identificadores de objeto en las solicitudes de la API. Los atacantes pueden explotar esta falla para ver o modificar registros sensibles sin la autorización adecuada."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-27T18:42:45.901829Z",
          "id": "CVE-2025-60982",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/handyteddy/Security-Advisories/blob/main/Educare-IDOR.md",
      "source": "[email protected]"
    },
    {
      "url": "https://www.educare.school/",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/handyteddy/Security-Advisories/blob/main/Educare-IDOR.md",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}