{"id":"CVE-2025-1642","state":"PUBLISHED","title":"Benner ModernaNet GetImageMedico resource injection","description":"A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been declared as critical. This vulnerability affects unknown code of the file /AGE0000700/GetImageMedico?fooId=1. The manipulation of the argument fooId leads to improper control of resource identifiers. The attack can be initiated remotely. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component.","publishedAt":"2025-02-25T00:31:04.569Z","updatedAt":"2025-02-25T14:38:09.789Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["Benner ModernaNet"],"affected":[{"vendor":"Benner","product":"ModernaNet","versions":[{"version":"1.0","status":"affected"},{"version":"1.1","status":"affected"}]}],"references":["https://vuldb.com/?id.296692","https://vuldb.com/?ctiid.296692","https://vuldb.com/?submit.499877","https://github.com/yago3008/cves"],"weaknesses":["CWE-99"],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/1xxx/CVE-2025-1642.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-1642","state":"PUBLISHED","datePublished":"2025-02-25T00:31:04.569Z","dateUpdated":"2025-02-25T14:38:09.789Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-02-24T17:22:14.270Z"},"containers":{"cna":{"title":"Benner ModernaNet GetImageMedico resource injection","descriptions":[{"lang":"en","value":"A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been declared as critical. This vulnerability affects unknown code of the file /AGE0000700/GetImageMedico?fooId=1. The manipulation of the argument fooId leads to improper control of resource identifiers. The attack can be initiated remotely. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component."},{"lang":"de","value":"In Benner ModernaNet bis 1.1.0 wurde eine Schwachstelle ausgemacht. Sie wurde als kritisch eingestuft. Betroffen ist eine unbekannte Verarbeitung der Datei /AGE0000700/GetImageMedico?fooId=1. Dank der Manipulation des Arguments fooId mit unbekannten Daten kann eine improper control of resource identifiers-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Ein Aktualisieren auf die Version 1.1.1 vermag dieses Problem zu lösen. Als bestmögliche Massnahme wird das Einspielen eines Upgrades empfohlen."}],"affected":[{"vendor":"Benner","product":"ModernaNet","versions":[{"version":"1.0","status":"affected"},{"version":"1.1","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.296692","name":"VDB-296692 | Benner ModernaNet GetImageMedico resource injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.296692","name":"VDB-296692 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.499877","name":"Submit #499877 | benner modernanet < 1.1.1 IDOR - Insecure Direct Object Reference","tags":["third-party-advisory"]},{"url":"https://github.com/yago3008/cves","tags":["related"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-99","type":"CWE","lang":"en","description":"Improper Control of Resource Identifiers"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-02-25T00:31:04.569Z"},"timeline":[{"time":"2025-02-24T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-02-24T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-02-24T18:28:01.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"y4g0 (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-25T14:06:28.666338Z","id":"CVE-2025-1642","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-25T14:38:09.789Z"}}]}}}