CVE-2025-3519

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-3519", "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c", "state": "PUBLISHED", "assignerShortName": "NCSC.ch", "dateReserved": "2025-04-11T14:18:18.443Z", "datePublished": "2025-04-22T08:51:41.681Z", "dateUpdated": "2025-04-22T18:55:44.071Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "Unblu Spark", "vendor": "Unblu inc.", "versions": [{"status": "unaffected", "version": "8.13.1", "versionType": "semver"}, {"lessThanOrEqual": "8.12.1", "status": "affected", "version": "8.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Andrei Dabrakou of Citadelo (andrei.dabrakou@citadelo.com)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An authorization bypass&nbsp;in&nbsp;Unblu Spark allows a&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">participant of a conversation&nbsp;</span>to replace an existing, uploaded file.<br><br>Every uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly. <br>"}], "value": "An authorization bypass\u00a0in\u00a0Unblu Spark allows a\u00a0participant of a conversation\u00a0to replace an existing, uploaded file.\n\nEvery uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 7, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "455daabc-a392-441d-aa46-37d35189897c", "shortName": "NCSC.ch", "dateUpdated": "2025-04-22T08:51:41.681Z"}, "references": [{"url": "https://www.unblu.com/en/docs/latest/security-bulletins/#UBL-2025-001"}], "source": {"advisory": "UBL-2025-001", "discovery": "EXTERNAL"}, "title": "Replace uploaded files knowing the file upload ID", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-22T18:55:22.227888Z", "id": "CVE-2025-3519", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-22T18:55:44.071Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3519", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-22T18:55:22.227888Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-22T18:55:38.847Z"}}], "cna": {"title": "Replace uploaded files knowing the file upload ID", "source": {"advisory": "UBL-2025-001", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Andrei Dabrakou of Citadelo (andrei.dabrakou@citadelo.com)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Unblu inc.", "product": "Unblu Spark", "versions": [{"status": "unaffected", "version": "8.13.1", "versionType": "semver"}, {"status": "affected", "version": "8.0.0", "versionType": "semver", "lessThanOrEqual": "8.12.1"}], "defaultStatus": "unknown"}], "references": [{"url": "https://www.unblu.com/en/docs/latest/security-bulletins/#UBL-2025-001"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "An authorization bypass\u00a0in\u00a0Unblu Spark allows a\u00a0participant of a conversation\u00a0to replace an existing, uploaded file.\n\nEvery uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly.", "supportingMedia": [{"type": "text/html", "value": "An authorization bypass&nbsp;in&nbsp;Unblu Spark allows a&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">participant of a conversation&nbsp;</span>to replace an existing, uploaded file.<br><br>Every uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly. <br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "455daabc-a392-441d-aa46-37d35189897c", "shortName": "NCSC.ch", "dateUpdated": "2025-04-22T08:51:41.681Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3519", "state": "PUBLISHED", "dateUpdated": "2025-04-22T18:55:44.071Z", "dateReserved": "2025-04-11T14:18:18.443Z", "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c", "datePublished": "2025-04-22T08:51:41.681Z", "assignerShortName": "NCSC.ch"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Unblu Spark", "vendor": "Unblu inc.", "versions": [{"status": "unaffected", "version": "8.13.1", "versionType": "semver"}, {"lessThanOrEqual": "8.12.1", "status": "affected", "version": "8.0.0", "versionType": "semver"}]}], "source": "vulnerability@ncsc.ch"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An authorization bypass\u00a0in\u00a0Unblu Spark allows a\u00a0participant of a conversation\u00a0to replace an existing, uploaded file.\n\nEvery uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly."}, {"lang": "es", "value": "Una omisi\u00f3n de autorizaci\u00f3n en Unblu Spark permite a un participante de una conversaci\u00f3n reemplazar un archivo subido. A cada archivo subido en Unblu se le asigna un ID \u00danico Universal (UUID) generado aleatoriamente. Si un participante de esta u otra conversaci\u00f3n accede a dicho ID de archivo, este puede usarse para reemplazarlo sin cambiar el nombre ni los detalles del archivo, ni el nombre del usuario que lo subi\u00f3. Durante la subida, las reglas de interceptaci\u00f3n de archivos y de tipos de archivo permitidos se aplican correctamente."}], "id": "CVE-2025-3519", "lastModified": "2026-06-17T09:20:06.037", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vulnerability@ncsc.ch", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3519", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-22T18:55:22.227888Z", "version": "2.0.3"}}]}, "published": "2025-04-22T09:15:15.660", "references": [{"source": "vulnerability@ncsc.ch", "url": "https://www.unblu.com/en/docs/latest/security-bulletins/#UBL-2025-001"}], "sourceIdentifier": "vulnerability@ncsc.ch", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "vulnerability@ncsc.ch", "type": "Secondary"}]}

{}

{}