CVE-2025-24502

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by spoofing the client IP address.

Metrics

CVSS 4.0 5.3/10

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-384

Affected software

No affected versions have been published.

Timeline

Published: Jan 30, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-245039.3A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server.CVE-2025-245045.3An improper input validation the CSRF filter results in unsanitized user input written to the application logs.CVE-2025-245058.8This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by uploadi CVE-2025-245065.3A specific authentication strategy allows to learn ids of PAM users associated with certain authentication types.CVE-2025-245078.9This vulnerability allows appliance compromise at boot time.CVE-2025-245086.4Extraction of Account Connectivity Credentials (ACCs) from the IT Management Agent secure storage CVE-2025-245106.5A vulnerability has been identified in MS/TP Point Pickup Module (All versions). Affected devices improperly handle specific incoming BACnet CVE-2025-245113.3Improper initialization in the Linux kernel-mode driver for some Intel(R) I350 Series Ethernet before version 5.19.2 may allow an authentica CVE-2025-245125.6Improper input validation for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.160 within Ring 2: Device Drivers ma CVE-2025-245134.8A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in CVE-2025-245148.8A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can b CVE-2025-245156.5NULL pointer dereference for some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable denial of service via loca