Vulnerability · Published Jan 16, 2025 · Assigned by INCIBE
CVE-2025-0473Incomplete Cleanup vulnerability in PMB platform
Medium 6.5
In plain English
A medium-severity security flaw in PMB platform from PMB Services. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Official description
Vulnerability in the PMB platform that allows an attacker to persist temporary files on the server, affecting versions 4.0.10 and above. This vulnerability exists in the file upload functionality on the ‘/pmb/authorities/import/iimport_authorities’ endpoint. When a file is uploaded via this resource, the server will create a temporary file that will be deleted after the client sends a POST request to ‘/pmb/authorities/import/iimport_authorities’. This workflow is automated by the web client, however an attacker can trap and launch the second POST request to prevent the temporary file from being deleted.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PMB Services | PMB platform | 4.0.10 |
Weakness: CWE-459 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N