CVE-2025-66291

{"id": "CVE-2025-66291", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66291", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-03T15:47:57.310761Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "orangehrm", "product": "orangehrm", "versions": [{"status": "affected", "version": ">= 5.0, < 5.8"}]}]}], "published": "2025-11-29T04:15:58.200", "references": [{"url": "https://github.com/orangehrm/orangehrm/commit/647133d0fdda989a4836845a6531277078a84607", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/orangehrm/orangehrm/security/advisories/GHSA-v32g-r8xx-4g6g", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the interview attachment retrieval endpoint in the Recruitment module serves files based solely on an authenticated session and user-supplied identifiers, without verifying whether the requester has permission to access the associated interview record. Because the server does not perform any recruitment-level authorization checks, an ESS-level user with no access to recruitment workflows can directly request interview attachment URLs and receive the corresponding files. This exposes confidential interview documents\u2014including candidate CVs, evaluations, and supporting files\u2014to unauthorized users. The issue arises from relying on predictable object identifiers and session presence rather than validating the user\u2019s association with the relevant recruitment process. This issue has been patched in version 5.8."}, {"lang": "es", "value": "OrangeHRM es un sistema integral de gesti\u00f3n de recursos humanos (HRM). Desde la versi\u00f3n 5.0 hasta la 5.7, el endpoint de recuperaci\u00f3n de archivos adjuntos de entrevista en el m\u00f3dulo de Reclutamiento sirve archivos bas\u00e1ndose \u00fanicamente en una sesi\u00f3n autenticada y en identificadores proporcionados por el usuario, sin verificar si el solicitante tiene permiso para acceder al registro de entrevista asociado. Debido a que el servidor no realiza ninguna comprobaci\u00f3n de autorizaci\u00f3n a nivel de reclutamiento, un usuario de nivel ESS sin acceso a los flujos de trabajo de reclutamiento puede solicitar directamente las URL de los archivos adjuntos de entrevista y recibir los archivos correspondientes. Esto expone documentos confidenciales de entrevista -incluyendo CVs de candidatos, evaluaciones y archivos de soporte- a usuarios no autorizados. El problema surge de depender de identificadores de objeto predecibles y de la presencia de la sesi\u00f3n en lugar de validar la asociaci\u00f3n del usuario con el proceso de reclutamiento relevante. Este problema ha sido parcheado en la versi\u00f3n 5.8."}], "lastModified": "2026-10-18T18:10:00.100", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:orangehrm:orangehrm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B30DE92-57A2-492F-A3F3-B8EFEEBEFE70", "versionEndExcluding": "5.8", "versionStartIncluding": "5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}