CVE-2025-41337
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'web' in '/backend/api/buscarSSOParametros.php'.
Risk Assessment
An attacker can access other users' data, breaching confidentiality and potentially enabling further attacks. This may result in leakage of personal information.
Recommendation
Apply the fixes provided by the CanalDenuncia.app vendor. Ensure proper authorization checks for the endpoint and verify user permissions.
Other vulnerabilities in CanalDenuncia.app
See all- CVE-2025-41345High
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST request with the parameters 'id_denuncia' and 'id_user' to '/backend/api/buscarDenunciasById.php'.
- CVE-2025-41344High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_archivo' parameter to '/backend/api/verArchivo.php'.
- CVE-2025-41343High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'email' parameter to '/backend/api/users/searchUserByEmail.php'.
- CVE-2025-41342High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_user' parameter to '/backend/api/buscarUsuarioId.php'.
- CVE-2025-41341High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_denuncia' and 'seguro' parameters to '/backend/api/buscarUsuarioByDenuncia.php'.
- CVE-2025-41340High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_tp_denuncia' and 'id_sociedad' parameters to '/backend/api/buscarTipoDenunciabyId.php'.
- CVE-2025-41339High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_sociedad' parameter to '/backend/api/buscarTipoDenuncia.php'.
- CVE-2025-41338High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_denuncia' and 'id_user' parameters to '/backend/api/buscarTestigoByIdDenunciaUsuario.php'.
- CVE-2025-41336High
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'web' in '/backend/api/buscarConfiguracionParametros.php'.
- CVE-2025-41335High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id' and 'id_sociedad' parameters to '/api/buscarEmpresaById.php'.
Original NVD description (English source)
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'web' in '/backend/api/buscarSSOParametros.php'.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS