SB2025030508 - Multiple vulnerabilities in GMOD Apollo
Published: March 5, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Incorrect Privilege Assignment (CVE-ID: CVE-2025-21092)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the affected product does not have sufficient logical or access checks when updating a user's information. A remote user can gain elevated privileges on the target system.
2) Path traversal (CVE-ID: CVE-2025-23410)
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when uploading organism or sequence data via the web interface. A remote attacker can gain access to the target system.
3) Missing Authentication for Critical Function (CVE-ID: CVE-2025-24924)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to certain functionality does not require authentication when passed with an administrative username. A remote user can gain access to the target system.
4) Information Exposure Through an Error Message (CVE-ID: CVE-2025-20002)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output after attempting to upload a file that does not meet pre-requisites. A remote attacker can gain unauthorized access to sensitive information on the system.
Remediation
Install update from vendor's website.