{"id":"CVE-2025-4762","state":"PUBLISHED","title":"Insecure Direct Object Reference (IDOR) vulnerability in eSignaViewer","description":"Insecure Direct Object Reference (IDOR) vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthenticated attacker to access arbitrary files in the document system via manipulation of file paths and object identifiers.","publishedAt":"2025-05-15T11:49:59.054Z","updatedAt":"2025-05-15T13:28:18.267Z","severity":{"score":2,"label":"Low","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","source":"Edgewatch"},"assigner":"Edgewatch","products":["Lleidanet PKI eSigna"],"affected":[{"vendor":"Lleidanet PKI","product":"eSigna","packageName":"eSignaViewer","defaultStatus":"affected","versions":[{"version":"1.3.2","status":"unaffected"},{"version":"1.4.4","status":"unaffected"},{"version":"4.0.4","status":"unaffected"},{"version":"4.1.4","status":"unaffected"},{"version":"5.0.2","status":"unaffected"},{"version":"5.1.2","status":"unaffected"},{"version":"5.2.4","status":"unaffected"},{"version":"5.3.3","status":"unaffected"},{"version":"5.4.1","status":"unaffected"}]}],"references":["https://edgewatch.com/vulnerability-advisories/path-traversal-and-idor-vulnerabilities-in-esignaviewer-allow-unauthorized-file-access/"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T20:09:23.771Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/4xxx/CVE-2025-4762.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-4762","state":"PUBLISHED","datePublished":"2025-05-15T11:49:59.054Z","dateUpdated":"2025-05-15T13:28:18.267Z","assignerShortName":"Edgewatch","assignerOrgId":"8ca67973-55d1-4246-bb7c-ce7e65ad8782","dateReserved":"2025-05-15T11:45:21.855Z"},"containers":{"cna":{"title":"Insecure Direct Object Reference (IDOR) vulnerability in eSignaViewer","descriptions":[{"lang":"en","value":"Insecure Direct Object Reference (IDOR) vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthenticated attacker to access arbitrary files in the document system via manipulation of file paths and object identifiers."}],"affected":[{"vendor":"Lleidanet PKI","product":"eSigna","packageName":"eSignaViewer","defaultStatus":"affected","versions":[{"version":"1.3.2","status":"unaffected"},{"version":"1.4.4","status":"unaffected"},{"version":"4.0.4","status":"unaffected"},{"version":"4.1.4","status":"unaffected"},{"version":"5.0.2","status":"unaffected"},{"version":"5.1.2","status":"unaffected"},{"version":"5.2.4","status":"unaffected"},{"version":"5.3.3","status":"unaffected"},{"version":"5.4.1","status":"unaffected"}]}],"references":[{"url":"https://edgewatch.com/vulnerability-advisories/path-traversal-and-idor-vulnerabilities-in-esignaviewer-allow-unauthorized-file-access/"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":2,"baseSeverity":"LOW","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20: Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Edgewatch","orgId":"8ca67973-55d1-4246-bb7c-ce7e65ad8782","dateUpdated":"2025-05-15T11:50:05.461Z"},"credits":[{"lang":"en","type":"finder","value":"Pablo Alcarria Lozano"}],"datePublic":"2024-12-03T12:00:00.000Z","impacts":[{"capecId":"CAPEC-122","descriptions":[{"lang":"en","value":"CAPEC-122: Insecure Direct Object Reference"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Users should immediately upgrade to the corresponding fixed version to eliminate these vulnerabilities and protect sensitive data from unauthorized access."}],"value":"Users should immediately upgrade to the corresponding fixed version to eliminate these vulnerabilities and protect sensitive data from unauthorized access."}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-15T13:26:47.028851Z","id":"CVE-2025-4762","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-15T13:28:18.267Z"}}]}}}