CVE-2025-41358 — Direct reference to insecure objects (IDOR) in CronosWeb from CronosWeb i2A
Direct Object Reference Vulnerability (IDOR) in i2A's CronosWeb, in versions prior to 25.00.00.12, inclusive. This vulnerability could allow an authenticated attacker to access …
Published: 2025-12-10 · CVSS: 8.3 · CVSS 4.0
Direct Object Reference Vulnerability (IDOR) in i2A's CronosWeb, in versions prior to 25.00.00.12, inclusive. This vulnerability could allow an authenticated attacker to access other users' documents by manipulating the ‘documentCode’ parameter in '/CronosWeb/Modulos/Personas/DocumentosPersonales/AdjuntarDocumentosPersonas'.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7