CVE-2025-64515

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-64515", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-11-05T21:15:39.400Z", "datePublished": "2025-11-18T22:39:48.150Z", "dateUpdated": "2025-11-19T17:01:01.839Z"}, "containers": {"cna": {"title": "Open Forms prefill data in read-only components can be tampered", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/open-formulieren/open-forms/security/advisories/GHSA-cp63-63mq-5wvf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/open-formulieren/open-forms/security/advisories/GHSA-cp63-63mq-5wvf"}, {"name": "https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#327-2025-11-18", "tags": ["x_refsource_MISC"], "url": "https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#327-2025-11-18"}, {"name": "https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#333-2025-11-18", "tags": ["x_refsource_MISC"], "url": "https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#333-2025-11-18"}], "affected": [{"vendor": "open-formulieren", "product": "open-forms", "versions": [{"version": ">= 3.3.0, < 3.3.3", "status": "affected"}, {"version": "< 3.2.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-11-18T22:39:48.150Z"}, "descriptions": [{"lang": "en", "value": "Open Forms allows users create and publish smart forms. Prior to versions 3.2.7 and 3.3.3, forms where the prefill data fields are dynamically set to readonly/disabled can be modified by malicious users deliberately trying to modify data they're not supposed to. For regular users, the form fields are marked as readonly and cannot be modified through the user interface. This issue has been patched in versions 3.2.7 and 3.3.3."}], "source": {"advisory": "GHSA-cp63-63mq-5wvf", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-19T17:00:52.614729Z", "id": "CVE-2025-64515", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-19T17:01:01.839Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Open Forms prefill data in read-only components can be tampered", "source": {"advisory": "GHSA-cp63-63mq-5wvf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "open-formulieren", "product": "open-forms", "versions": [{"status": "affected", "version": ">= 3.3.0, < 3.3.3"}, {"status": "affected", "version": "< 3.2.7"}]}], "references": [{"url": "https://github.com/open-formulieren/open-forms/security/advisories/GHSA-cp63-63mq-5wvf", "name": "https://github.com/open-formulieren/open-forms/security/advisories/GHSA-cp63-63mq-5wvf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#327-2025-11-18", "name": "https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#327-2025-11-18", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#333-2025-11-18", "name": "https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#333-2025-11-18", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Open Forms allows users create and publish smart forms. Prior to versions 3.2.7 and 3.3.3, forms where the prefill data fields are dynamically set to readonly/disabled can be modified by malicious users deliberately trying to modify data they're not supposed to. For regular users, the form fields are marked as readonly and cannot be modified through the user interface. This issue has been patched in versions 3.2.7 and 3.3.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-11-18T22:39:48.150Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-64515", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-19T17:00:52.614729Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2025-11-19T17:00:59.221Z"}}]}, "cveMetadata": {"cveId": "CVE-2025-64515", "state": "PUBLISHED", "dateUpdated": "2025-11-18T22:39:48.150Z", "dateReserved": "2025-11-05T21:15:39.400Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-11-18T22:39:48.150Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "open-forms", "vendor": "open-formulieren", "versions": [{"status": "affected", "version": ">= 3.3.0, < 3.3.3"}, {"status": "affected", "version": "< 3.2.7"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:maykinmedia:open_forms:*:*:*:*:*:*:*:*", "matchCriteriaId": "6357DA53-9F3D-4C21-B0C3-66637A1689B6", "versionEndExcluding": "3.2.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:maykinmedia:open_forms:*:*:*:*:*:*:*:*", "matchCriteriaId": "2833EAC3-CAC0-4F95-ADC7-ED250653BF3B", "versionEndExcluding": "3.3.3", "versionStartIncluding": "3.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Open Forms allows users create and publish smart forms. Prior to versions 3.2.7 and 3.3.3, forms where the prefill data fields are dynamically set to readonly/disabled can be modified by malicious users deliberately trying to modify data they're not supposed to. For regular users, the form fields are marked as readonly and cannot be modified through the user interface. This issue has been patched in versions 3.2.7 and 3.3.3."}, {"lang": "es", "value": "Open Forms permite a los usuarios crear y publicar formularios inteligentes. Versiones anteriores a las versiones 3.2.7 y 3.3.3, los formularios donde los campos de datos de precarga se configuran din\u00e1micamente como de solo lectura/deshabilitados pueden ser modificados por usuarios malintencionados que intentan deliberadamente modificar datos que no deber\u00edan. Para los usuarios habituales, los campos del formulario est\u00e1n marcados como de solo lectura y no pueden ser modificados a trav\u00e9s de la interfaz de usuario. Este problema ha sido parcheado en las versiones 3.2.7 y 3.3.3."}], "id": "CVE-2025-64515", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64515", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-19T17:00:52.614729Z", "version": "2.0.3"}}]}, "published": "2025-11-18T23:15:55.690", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#327-2025-11-18"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/open-formulieren/open-forms/blob/bcf2dc54c695fb7c8c58712627d82c4b766248b6/CHANGELOG.rst#333-2025-11-18"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/open-formulieren/open-forms/security/advisories/GHSA-cp63-63mq-5wvf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"created": "2025-11-21T09:16:22.151815+00:00", "updated": "2025-11-21T09:16:22.151854+00:00", "vendors": ["maykinmedia", "maykinmedia$PRODUCT$open_forms"]}