CVE-2025-2220

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-2220", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2025-03-11T15:18:30.501Z", "datePublished": "2025-03-12T01:00:06.163Z", "dateUpdated": "2025-03-12T14:56:55.846Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-03-12T01:00:06.163Z"}, "title": "Odyssey CMS reCAPTCHA odyssey_contact_form.php key management", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-320", "lang": "en", "description": "Key Management Error"}]}], "affected": [{"vendor": "Odyssey", "product": "CMS", "versions": [{"version": "10.0", "status": "affected"}, {"version": "10.1", "status": "affected"}, {"version": "10.2", "status": "affected"}, {"version": "10.3", "status": "affected"}, {"version": "10.4", "status": "affected"}, {"version": "10.5", "status": "affected"}, {"version": "10.6", "status": "affected"}, {"version": "10.7", "status": "affected"}, {"version": "10.8", "status": "affected"}, {"version": "10.9", "status": "affected"}, {"version": "10.10", "status": "affected"}, {"version": "10.11", "status": "affected"}, {"version": "10.12", "status": "affected"}, {"version": "10.13", "status": "affected"}, {"version": "10.14", "status": "affected"}, {"version": "10.15", "status": "affected"}, {"version": "10.16", "status": "affected"}, {"version": "10.17", "status": "affected"}, {"version": "10.18", "status": "affected"}, {"version": "10.19", "status": "affected"}, {"version": "10.20", "status": "affected"}, {"version": "10.21", "status": "affected"}, {"version": "10.22", "status": "affected"}, {"version": "10.23", "status": "affected"}, {"version": "10.24", "status": "affected"}, {"version": "10.25", "status": "affected"}, {"version": "10.26", "status": "affected"}, {"version": "10.27", "status": "affected"}, {"version": "10.28", "status": "affected"}, {"version": "10.29", "status": "affected"}, {"version": "10.30", "status": "affected"}, {"version": "10.31", "status": "affected"}, {"version": "10.32", "status": "affected"}, {"version": "10.33", "status": "affected"}, {"version": "10.34", "status": "affected"}], "modules": ["reCAPTCHA Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Odyssey CMS up to 10.34. It has been classified as problematic. Affected is an unknown function of the file /modules/odyssey_contact_form/odyssey_contact_form.php of the component reCAPTCHA Handler. The manipulation of the argument g-recaptcha-response leads to key management error. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "de", "value": "Es wurde eine problematische Schwachstelle in Odyssey CMS bis 10.34 ausgemacht. Es geht dabei um eine nicht klar definierte Funktion der Datei /modules/odyssey_contact_form/odyssey_contact_form.php der Komponente reCAPTCHA Handler. Durch Manipulation des Arguments g-recaptcha-response mit unbekannten Daten kann eine key management error-Schwachstelle ausgenutzt werden. Der Angriff hat dabei lokal zu erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N"}}], "timeline": [{"time": "2025-03-11T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2025-03-11T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2025-03-11T16:23:33.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "secuserx (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.299292", "name": "VDB-299292 | Odyssey CMS reCAPTCHA odyssey_contact_form.php key management", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.299292", "name": "VDB-299292 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.512367", "name": "Submit #512367 | Odyssey CMS 10.35 Use of Hard-coded, Security-relevant Constants", "tags": ["third-party-advisory"]}, {"url": "https://github.com/secuserx/CVE/blob/main/%5BHardcoded%20reCAPTCHA%20secret%20key%5D%20found%20in%20Odyssey%20CMS%2010.35%20-%20(odyssey_contact_form.php).md", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-12T14:56:16.816048Z", "id": "CVE-2025-2220", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-12T14:56:55.846Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-2220", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-12T14:56:16.816048Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-12T14:56:51.284Z"}}], "cna": {"title": "Odyssey CMS reCAPTCHA odyssey_contact_form.php key management", "credits": [{"lang": "en", "type": "reporter", "value": "secuserx (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N"}}], "affected": [{"vendor": "Odyssey", "modules": ["reCAPTCHA Handler"], "product": "CMS", "versions": [{"status": "affected", "version": "10.0"}, {"status": "affected", "version": "10.1"}, {"status": "affected", "version": "10.2"}, {"status": "affected", "version": "10.3"}, {"status": "affected", "version": "10.4"}, {"status": "affected", "version": "10.5"}, {"status": "affected", "version": "10.6"}, {"status": "affected", "version": "10.7"}, {"status": "affected", "version": "10.8"}, {"status": "affected", "version": "10.9"}, {"status": "affected", "version": "10.10"}, {"status": "affected", "version": "10.11"}, {"status": "affected", "version": "10.12"}, {"status": "affected", "version": "10.13"}, {"status": "affected", "version": "10.14"}, {"status": "affected", "version": "10.15"}, {"status": "affected", "version": "10.16"}, {"status": "affected", "version": "10.17"}, {"status": "affected", "version": "10.18"}, {"status": "affected", "version": "10.19"}, {"status": "affected", "version": "10.20"}, {"status": "affected", "version": "10.21"}, {"status": "affected", "version": "10.22"}, {"status": "affected", "version": "10.23"}, {"status": "affected", "version": "10.24"}, {"status": "affected", "version": "10.25"}, {"status": "affected", "version": "10.26"}, {"status": "affected", "version": "10.27"}, {"status": "affected", "version": "10.28"}, {"status": "affected", "version": "10.29"}, {"status": "affected", "version": "10.30"}, {"status": "affected", "version": "10.31"}, {"status": "affected", "version": "10.32"}, {"status": "affected", "version": "10.33"}, {"status": "affected", "version": "10.34"}]}], "timeline": [{"lang": "en", "time": "2025-03-11T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2025-03-11T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2025-03-11T16:23:33.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.299292", "name": "VDB-299292 | Odyssey CMS reCAPTCHA odyssey_contact_form.php key management", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.299292", "name": "VDB-299292 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.512367", "name": "Submit #512367 | Odyssey CMS 10.35 Use of Hard-coded, Security-relevant Constants", "tags": ["third-party-advisory"]}, {"url": "https://github.com/secuserx/CVE/blob/main/%5BHardcoded%20reCAPTCHA%20secret%20key%5D%20found%20in%20Odyssey%20CMS%2010.35%20-%20(odyssey_contact_form.php).md", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Odyssey CMS up to 10.34. It has been classified as problematic. Affected is an unknown function of the file /modules/odyssey_contact_form/odyssey_contact_form.php of the component reCAPTCHA Handler. The manipulation of the argument g-recaptcha-response leads to key management error. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "de", "value": "Es wurde eine problematische Schwachstelle in Odyssey CMS bis 10.34 ausgemacht. Es geht dabei um eine nicht klar definierte Funktion der Datei /modules/odyssey_contact_form/odyssey_contact_form.php der Komponente reCAPTCHA Handler. Durch Manipulation des Arguments g-recaptcha-response mit unbekannten Daten kann eine key management error-Schwachstelle ausgenutzt werden. Der Angriff hat dabei lokal zu erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-320", "description": "Key Management Error"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-03-12T01:00:06.163Z"}}}, "cveMetadata": {"cveId": "CVE-2025-2220", "state": "PUBLISHED", "dateUpdated": "2025-03-12T14:56:55.846Z", "dateReserved": "2025-03-11T15:18:30.501Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2025-03-12T01:00:06.163Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"modules": ["reCAPTCHA Handler"], "product": "CMS", "vendor": "Odyssey", "versions": [{"status": "affected", "version": "10.0"}, {"status": "affected", "version": "10.1"}, {"status": "affected", "version": "10.2"}, {"status": "affected", "version": "10.3"}, {"status": "affected", "version": "10.4"}, {"status": "affected", "version": "10.5"}, {"status": "affected", "version": "10.6"}, {"status": "affected", "version": "10.7"}, {"status": "affected", "version": "10.8"}, {"status": "affected", "version": "10.9"}, {"status": "affected", "version": "10.10"}, {"status": "affected", "version": "10.11"}, {"status": "affected", "version": "10.12"}, {"status": "affected", "version": "10.13"}, {"status": "affected", "version": "10.14"}, {"status": "affected", "version": "10.15"}, {"status": "affected", "version": "10.16"}, {"status": "affected", "version": "10.17"}, {"status": "affected", "version": "10.18"}, {"status": "affected", "version": "10.19"}, {"status": "affected", "version": "10.20"}, {"status": "affected", "version": "10.21"}, {"status": "affected", "version": "10.22"}, {"status": "affected", "version": "10.23"}, {"status": "affected", "version": "10.24"}, {"status": "affected", "version": "10.25"}, {"status": "affected", "version": "10.26"}, {"status": "affected", "version": "10.27"}, {"status": "affected", "version": "10.28"}, {"status": "affected", "version": "10.29"}, {"status": "affected", "version": "10.30"}, {"status": "affected", "version": "10.31"}, {"status": "affected", "version": "10.32"}, {"status": "affected", "version": "10.33"}, {"status": "affected", "version": "10.34"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:odysseyautomation:odyssey_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "18A13812-D1B1-4E64-BFC6-F77BD44C7C19", "versionEndIncluding": "10.34", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Odyssey CMS up to 10.34. It has been classified as problematic. Affected is an unknown function of the file /modules/odyssey_contact_form/odyssey_contact_form.php of the component reCAPTCHA Handler. The manipulation of the argument g-recaptcha-response leads to key management error. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en Odyssey CMS hasta la versi\u00f3n 10.34. Se ha clasificado como problem\u00e1tica. Se ve afectada una funci\u00f3n desconocida del archivo /modules/odyssey_contact_form/odyssey_contact_form.php del componente reCAPTCHA Handler. La manipulaci\u00f3n del argumento g-recaptcha-response provoca un error en la gesti\u00f3n de claves. Se requiere acceso local para abordar este ataque. Se ha hecho p\u00fablico el exploit y puede que sea utilizado. Se contact\u00f3 al proveedor con antelaci\u00f3n para informarle sobre esta divulgaci\u00f3n, pero no respondi\u00f3."}], "id": "CVE-2025-2220", "lastModified": "2026-06-17T09:06:33.933", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 1.7, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-2220", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-03-12T14:56:16.816048Z", "version": "2.0.3"}}]}, "published": "2025-03-12T02:15:19.300", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/secuserx/CVE/blob/main/%5BHardcoded%20reCAPTCHA%20secret%20key%5D%20found%20in%20Odyssey%20CMS%2010.35%20-%20(odyssey_contact_form.php).md"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.299292"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.299292"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.512367"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-320"}], "source": "cna@vuldb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}