CVE-2025-62714

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-62714", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-10-20T19:41:22.740Z", "datePublished": "2025-10-24T15:41:59.899Z", "dateUpdated": "2025-10-24T17:29:39.462Z"}, "containers": {"cna": {"title": "Karmada Dashboard API Unauthorized Access Vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/karmada-io/dashboard/security/advisories/GHSA-5qjg-9mjh-4r92", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/karmada-io/dashboard/security/advisories/GHSA-5qjg-9mjh-4r92"}, {"name": "https://github.com/karmada-io/dashboard/pull/271", "tags": ["x_refsource_MISC"], "url": "https://github.com/karmada-io/dashboard/pull/271"}, {"name": "https://github.com/karmada-io/dashboard/pull/280", "tags": ["x_refsource_MISC"], "url": "https://github.com/karmada-io/dashboard/pull/280"}, {"name": "https://github.com/karmada-io/dashboard/commit/8457b8bb87725e2371a638ca5a255fd2895c70f1", "tags": ["x_refsource_MISC"], "url": "https://github.com/karmada-io/dashboard/commit/8457b8bb87725e2371a638ca5a255fd2895c70f1"}, {"name": "https://github.com/karmada-io/dashboard/commit/d2d04909f25e96b4c20fa6b636c398bd1636ee06", "tags": ["x_refsource_MISC"], "url": "https://github.com/karmada-io/dashboard/commit/d2d04909f25e96b4c20fa6b636c398bd1636ee06"}, {"name": "https://github.com/karmada-io/dashboard/releases/tag/v0.2.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/karmada-io/dashboard/releases/tag/v0.2.0"}], "affected": [{"vendor": "karmada-io", "product": "dashboard", "versions": [{"version": "< 0.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-24T15:41:59.899Z"}, "descriptions": [{"lang": "en", "value": "Karmada Dashboard is a general-purpose, web-based control panel for Karmada which is a multi-cluster management project. Prior to version 0.2.0, there is an authentication bypass vulnerability in the Karmada Dashboard API. The backend API endpoints (e.g., /api/v1/secret, /api/v1/service) did not enforce authentication, allowing unauthenticated users to access sensitive cluster information such as Secrets and Services directly. Although the web UI required a valid JWT for access, the API itself remained exposed to direct requests without any authentication checks. Any user or entity with network access to the Karmada Dashboard service could exploit this vulnerability to retrieve sensitive data."}], "source": {"advisory": "GHSA-5qjg-9mjh-4r92", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-24T17:29:25.879674Z", "id": "CVE-2025-62714", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-24T17:29:39.462Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-62714", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-24T17:29:25.879674Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-24T16:41:19.129Z"}}], "cna": {"title": "Karmada Dashboard API Unauthorized Access Vulnerability", "source": {"advisory": "GHSA-5qjg-9mjh-4r92", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "karmada-io", "product": "dashboard", "versions": [{"status": "affected", "version": "< 0.2.0"}]}], "references": [{"url": "https://github.com/karmada-io/dashboard/security/advisories/GHSA-5qjg-9mjh-4r92", "name": "https://github.com/karmada-io/dashboard/security/advisories/GHSA-5qjg-9mjh-4r92", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/karmada-io/dashboard/pull/271", "name": "https://github.com/karmada-io/dashboard/pull/271", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/karmada-io/dashboard/pull/280", "name": "https://github.com/karmada-io/dashboard/pull/280", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/karmada-io/dashboard/commit/8457b8bb87725e2371a638ca5a255fd2895c70f1", "name": "https://github.com/karmada-io/dashboard/commit/8457b8bb87725e2371a638ca5a255fd2895c70f1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/karmada-io/dashboard/commit/d2d04909f25e96b4c20fa6b636c398bd1636ee06", "name": "https://github.com/karmada-io/dashboard/commit/d2d04909f25e96b4c20fa6b636c398bd1636ee06", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/karmada-io/dashboard/releases/tag/v0.2.0", "name": "https://github.com/karmada-io/dashboard/releases/tag/v0.2.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Karmada Dashboard is a general-purpose, web-based control panel for Karmada which is a multi-cluster management project. Prior to version 0.2.0, there is an authentication bypass vulnerability in the Karmada Dashboard API. The backend API endpoints (e.g., /api/v1/secret, /api/v1/service) did not enforce authentication, allowing unauthenticated users to access sensitive cluster information such as Secrets and Services directly. Although the web UI required a valid JWT for access, the API itself remained exposed to direct requests without any authentication checks. Any user or entity with network access to the Karmada Dashboard service could exploit this vulnerability to retrieve sensitive data."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-24T15:41:59.899Z"}}}, "cveMetadata": {"cveId": "CVE-2025-62714", "state": "PUBLISHED", "dateUpdated": "2025-10-24T17:29:39.462Z", "dateReserved": "2025-10-20T19:41:22.740Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-24T15:41:59.899Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "dashboard", "vendor": "karmada-io", "versions": [{"status": "affected", "version": "< 0.2.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Karmada Dashboard is a general-purpose, web-based control panel for Karmada which is a multi-cluster management project. Prior to version 0.2.0, there is an authentication bypass vulnerability in the Karmada Dashboard API. The backend API endpoints (e.g., /api/v1/secret, /api/v1/service) did not enforce authentication, allowing unauthenticated users to access sensitive cluster information such as Secrets and Services directly. Although the web UI required a valid JWT for access, the API itself remained exposed to direct requests without any authentication checks. Any user or entity with network access to the Karmada Dashboard service could exploit this vulnerability to retrieve sensitive data."}, {"lang": "es", "value": "Karmada Dashboard es un panel de control de prop\u00f3sito general, basado en web, para Karmada, que es un proyecto de gesti\u00f3n multi-cl\u00faster. Antes de la versi\u00f3n 0.2.0, existe una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en la API de Karmada Dashboard. Los endpoints de la API de backend (por ejemplo, /api/v1/secret, /api/v1/service) no aplicaban autenticaci\u00f3n, permitiendo a usuarios no autenticados acceder directamente a informaci\u00f3n sensible del cl\u00faster como Secrets y Services. Aunque la interfaz de usuario web requer\u00eda un JWT v\u00e1lido para el acceso, la propia API permanec\u00eda expuesta a solicitudes directas sin ninguna verificaci\u00f3n de autenticaci\u00f3n. Cualquier usuario o entidad con acceso de red al servicio de Karmada Dashboard podr\u00eda explotar esta vulnerabilidad para recuperar datos sensibles."}], "id": "CVE-2025-62714", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62714", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-24T17:29:25.879674Z", "version": "2.0.3"}}]}, "published": "2025-10-24T16:28:01.980", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/karmada-io/dashboard/commit/8457b8bb87725e2371a638ca5a255fd2895c70f1"}, {"source": "security-advisories@github.com", "url": "https://github.com/karmada-io/dashboard/commit/d2d04909f25e96b4c20fa6b636c398bd1636ee06"}, {"source": "security-advisories@github.com", "url": "https://github.com/karmada-io/dashboard/pull/271"}, {"source": "security-advisories@github.com", "url": "https://github.com/karmada-io/dashboard/pull/280"}, {"source": "security-advisories@github.com", "url": "https://github.com/karmada-io/dashboard/releases/tag/v0.2.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/karmada-io/dashboard/security/advisories/GHSA-5qjg-9mjh-4r92"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-10-27T22:10:31.071566+00:00", "updated": "2025-10-27T22:10:31.071593+00:00", "vendors": ["karmada-io", "karmada-io$PRODUCT$karmada"]}