TIME-SEA-PLUS CVE-2025-12304

Q: What is the CVSS score of CVE-2025-12304?

CVE-2025-12304 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Incorrect Privilege Assignment (CWE-266)

2025-10-27 cna@vuldb.com

Information Disclosure Java

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:33 vuln.today

DescriptionCVE.org

A vulnerability has been found in dulaiduwang003 TIME-SEA-PLUS up to fb299162f18498dd9cf17da906886d80a077d53b. This affects the function alipayIsSucceed of the file PayController.java of the component Order Status Handler. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

AnalysisAI

Improper authorization in TIME-SEA-PLUS PayController.java alipayIsSucceed function allows authenticated remote attackers to disclose sensitive information related to order status handling. The vulnerability affects versions up to commit fb299162f18498dd9cf17da906886d80a077d53b, with publicly available exploit code disclosed but low real-world exploitation probability (EPSS 0.03%). Attack requires valid user credentials and network access but does not enable privilege escalation or data modification.

Technical ContextAI

The vulnerability exists in the alipayIsSucceed method of PayController.java, a Java component responsible for order status handling and payment verification integration with Alipay (Chinese third-party payment platform). The root cause is classified under CWE-266 (Improper Privilege Management), indicating the authorization check fails to properly validate whether the authenticated user should access the requested order status information. This is typical of broken access control in REST API endpoints where user identity is verified but authorization context (ownership of order, user role, transaction details) is not enforced. The vulnerability affects a GitHub-hosted open-source project (dulaiduwang003/TIME-SEA-PLUS), suggesting community-driven code with potentially limited security review.

Affected ProductsAI

TIME-SEA-PLUS (dulaiduwang003/TIME-SEA-PLUS) is affected in versions up to and including commit fb299162f18498dd9cf17da906886d80a077d53b. The project is hosted on GitHub as open-source software. CPE data not available; affected component is PayController.java with the alipayIsSucceed function. No specific semantic versioning (e.g., v1.0.0) identified in available references.

RemediationAI

Patch the PayController.java alipayIsSucceed method to implement proper authorization checks before returning order status information. The fix must verify that the authenticated user owns or has permission to access the queried order (e.g., userId matches order.userId or user has admin role). No vendor-released patch version identified at time of analysis; developers should audit the GitHub repository for any merged fix commits post-fb299162f18498dd9cf17da906886d80a077d53b or contact the project maintainer. Until patched, operators should implement API-level mitigations: restrict access to the /PayController endpoints via role-based access control (RBAC) to limit exposure to trusted internal services only, enable request logging and alerting on alipayIsSucceed calls to detect unauthorized access patterns, and consider rate-limiting or requiring additional verification for order status queries. These controls reduce blast radius but do not eliminate the underlying vulnerability.