Multivendorx EUVD-2025-17536

The CVSS 3.1 vector (7.5 High) reflects a significant confidentiality impact (C:H) with no integrity or availability compromise, consistent with information disclosure. The attack complexity is low (AC:L), requires no privileges (PR:N), and requires no user interaction (UI:N), making exploitation trivial from a technical standpoint. The network attack vector (AV:N) means any internet-connected instance is at risk. Without explicit EPSS scores or KEV confirmation provided, the real-world risk depends on: (1) whether MultiVendorX instances are commonly internet-exposed, (2) the criticality of data leaked (customer PII, payment tokens, admin credentials), and (3) deployment prevalence. For a multi-vendor marketplace platform, exposed customer data or vendor credentials represent significant business and compliance risk (GDPR, PCI-DSS). The absence of reported active exploitation does not diminish risk; low-complexity remote unauthenticated attacks on information disclosure typically see swift weaponization once disclosed. This should be treated as a priority patch candidate, particularly for production instances.

An unauthenticated attacker discovers a publicly accessible MultiVendorX API endpoint (e.g., /api/products, /api/vendors, or /api/cart) that returns product or vendor data. Due to CWE-201, the API response includes unintended sensitive fields such as internal vendor IDs, payment processor tokens, admin email addresses, or API keys used for third-party integrations. The attacker makes simple HTTP GET requests to enumerate endpoints and extract this data without authentication (PR:N, UI:N). With leaked API keys or credentials, the attacker pivots to access admin panels, exfiltrate customer databases, or compromise integrated payment systems. The attack requires no special tools (AC:L) and can be performed by any network-connected party, making it suitable for automated reconnaissance or opportunistic exploitation during pre-compromise reconnaissance. A POC would likely consist of curl commands to call affected endpoints and demonstrate sensitive data disclosure in responses.