CVE-2025-61163

{"id": "CVE-2025-61163", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61163", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-27T19:15:16.362680Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-08-26T19:16:44.290", "references": [{"url": "https://cohere.com/north", "source": "cve@mitre.org"}, {"url": "https://github.com/bdadoa/Cohere---North-AI-1.1.5---Vulnerabilities/blob/main/CVE-2025-61163.md", "source": "cve@mitre.org"}, {"url": "https://github.com/bdadoa/Cohere---North-AI-1.1.5---Vulnerabilities/blob/main/CVE-2025-61163.md", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-942"}]}], "descriptions": [{"lang": "en", "value": "Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests."}, {"lang": "es", "value": "Se descubri\u00f3 que Cohere North AI v1.1.5 contiene una pol\u00edtica de dominio cruzado excesivamente permisiva con dominios no confiables. Esto ocurre porque el servidor no valida la cabecera Origin de las solicitudes de conexi\u00f3n entrantes."}], "lastModified": "2026-10-26T21:10:00.170", "sourceIdentifier": "cve@mitre.org"}