EUVD-2025-19063CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3Tags
Description
ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to a server-side request forgery vulnerability which could allow an unauthenticated attacker to retrieve information from other servers.
Analysis
ControlID iDSecure On-premises versions 4.7.48.0 and earlier contain a server-side request forgery (SSRF) vulnerability that allows unauthenticated attackers to make arbitrary requests from the vulnerable server to internal or external systems, potentially exposing sensitive information. The CVSS 7.5 score reflects the high confidentiality impact and network-accessible attack vector, though integrity and availability are not compromised. This vulnerability requires immediate patching as it requires no authentication or user interaction.
Technical Context
This vulnerability is classified as CWE-918 (Server-Side Request Forgery), a critical class of vulnerability where the application fails to properly validate or sanitize user-supplied input before making backend HTTP/network requests. In ControlID iDSecure On-premises, the affected versions likely contain an endpoint or service component that accepts user input (URLs, hostnames, or similar parameters) and passes it to internal request libraries without adequate validation. This allows attackers to bypass network segmentation and access resources that should only be reachable internally—such as cloud metadata services, internal APIs, database servers, or administrative interfaces. The affected product is ControlID iDSecure On-premises (CPE pattern: cpe:2.3:a:controlid:idsecure:*:*:*:*:*:*:*:*), with all versions up to and including 4.7.48.0 confirmed vulnerable.
Affected Products
iDSecure On-premises (4.7.48.0 and prior)
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today