CVE-2025-52924

Sažetak

In One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on the value of an untrusted X-RequestId HTTP request header.

Reference

https://oneidentity.com
https://onelogin.service-now.com/support?id=kb_article&sys_id=59fe4c3c972a2610c90c3b0e6253afef&kb_category=a0d76d70db185340d5505eea4b96199f
https://onelogin.service-now.com/support?id=kb_article&sys_id=59fe4c3c972a2610c90c3b0e6253afef&kb_category=a0d76d70db185340d5505eea4b96199f

CVSS

Base:	4.0
Impact:	1.4
Exploitability:	2.2

Pristup

Vektor	Složenost	Autentikacija
NETWORK	HIGH	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
LOW	NONE	NONE

CVSS vektor

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Zadnje važnije ažuriranje

23-07-2025 - 16:15

Objavljeno

19-07-2025 - 03:15