CVE-2025-55741
UnoPim has Broken Access Control
描述
### Summary In Unopim, it is possible to create roles and choose the privileges. However, users without the “Delete” privilege for Products cannot delete a single product via the standard endpoint (expected behavior), but can still delete products via the mass-delete endpoint, even when the request contains only one product ID. **Severity**: High CVSS Score 8.1 (CVSS 3.1 Vector: [AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H&version=3.1)) **Category**: Broken Access Control / Missing Authorization (OWASP A01:2021) **Impact**: Unauthorized product deletion -> data loss, possible business disruption ### Affected Behavior **Single delete (enforced):** **DELETE** `/admin/catalog/products/{id}` returns 401 with "This action is unauthorized" for users lacking the Delete privilege. **Mass delete (not enforced):** **POST** `/admin/catalog/products/mass-delete` allows deletion without the Delete privilege. This occurs for both multiple IDs and a single ID submitted to the bulk endpoint. ### PoC A video was captured in Burp Suite for a proof of concept. The cookies were used directly from Burp Suite and rendered the My Account page to prove what cookies belong to what users. The video PoC is listed in references. ### Impact Unauthorized product deletion -> data loss, possible business disruption
如何修補 CVE-2025-55741
要修補 CVE-2025-55741,請將受影響套件升級到下列已修補版本。
- —升級至 0.3.1 或更新版本
CVE-2025-55741 正在被利用嗎?
低 — EPSS 為 0.4%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- from 0, < 0.3.1