CVE-2025-3519
HIGH EPSS 14.3%
Published Apr 22, 20251y ago · Modified Jun 17, 20262w ago
7.0 CVSS 4.0
Published Apr 22, 2025 1y ago
Last Modified Jun 17, 2026 2w ago
Description
An authorization bypass in Unblu Spark allows a participant of a conversation to replace an existing, uploaded file. Every uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity High
Privileges Required Low
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
14.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-639
References 1
- unblu.com https://www.unblu.com/en/docs/latest/security-bulletins/#UBL-2025-001
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.