Security Advisory

CVE-2025-48881

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2025-05-30 05:21:30

Last updated 2025-06-04 20:49:45

Assigner GitHub_M

CVSS score 8.3

State PUBLISHED

Description

Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations. This issue has been patched in version 12.13.0.RELEASE. A workaround for this issue involves overriding the endpoint security as defined in ObjectenApiHttpSecurityConfigurer and ObjectManagementHttpSecurityConfigurer. Depending on the implementation, this could result in loss of functionality.

← Browse all CVEs View on cve.org ↗