CVE-2025-3575 - Insecure Direct Object Reference en Deporsite de T-INNOVA

Back Back to CVE browser

HIGH

Insecure Direct Object Reference en Deporsite de T-INNOVA

Published Apr 15, 2025

8.7

HIGH

CVSS 4.0

EPSS 0.46%

Description

Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario" parameter in "/helper/Familia/establecerUsuarioSeleccion" endpoint.

Affected products

Vendor T-Innova Product Deporsite Default
unaffected
Affected
- v05.29.0907

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
T-Innova	Deporsite	unaffected	Affected v05.29.0907

Remediation

Vendor solution

The vulnerabilities have been fixed by the T-INNOVA team in release 2024.02 (DSuite2024 v06.1287 fix2). T-Innova has identified the customers using the affected module, and has applied the corresponding patch.

Weaknesses (1)

CWE-639

Authorization Bypass

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-10931		Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-deporsite-t-innova

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner INCIBE

Published Apr 15, 2025

Updated Apr 15, 2025

Reserved Apr 14, 2025

Link CVE-2025-3575

CISA Vulnrichment

Updated Apr 15, 2025

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-3575

Red Hat

No data

ENISA EUVD

Assigner INCIBE

Published Apr 15, 2025

Updated Apr 15, 2025

Link EUVD-2025-10931

GitHub

No data