-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability (GHSA-965r-9cg9-g42p / CVE-2025-48881) lies in an incorrect authorization mechanism within the Valtimo backend libraries, specifically affecting the 'objecten-api' and 'object-management' components. According to the advisory, all objects for which an object-management configuration exists can be manipulated by unauthorized (but authenticated) users.
The advisory explicitly mentions that a workaround involves overriding endpoint security defined in ObjectenApiHttpSecurityConfigurer and ObjectManagementHttpSecurityConfigurer. This strongly suggests that these two classes contain the flawed security configurations. In Spring Security, such HttpSecurityConfigurer classes typically have a configure(HttpSecurity http) method (or similar) where security rules (like authentication and authorization requirements for specific URL patterns) are defined. The vulnerability implies that these configurations are too permissive, failing to correctly enforce authorization checks for the object-related API endpoints.
Since no patch is available, the analysis relies on the description provided in the security advisory. The functions listed are inferred to be the primary locations of the faulty security logic based on their names and the context of Spring Security configuration. An attacker exploiting this vulnerability would interact with API endpoints whose security is governed by these configuration classes. During such an interaction, the methods within these classes responsible for applying security filters and rules would be part of the execution flow, and if a profiler were attached, these configuration methods (or methods they call) would appear in the stack trace when security decisions are being made (or, in this case, improperly made).
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.ritense.valtimo:objecten-api | maven | >= 11.0.0.RELEASE, <= 11.3.3.RELEASE | |
| com.ritense.valtimo:object-management | maven | >= 11.0.0.RELEASE, <= 11.3.3.RELEASE | |
| com.ritense.valtimo:object-management | maven | >= 12.0.0.RELEASE, <= 12.12.0.RELEASE | |
| com.ritense.valtimo:objecten-api | maven | >= 12.0.0.RELEASE, <= 12.12.0.RELEASE |