CVE-2025-57212
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive information via a crafted request.
Risk Assessment
An attacker could access sensitive data, potentially leading to a breach of information confidentiality.
Recommendation
Implement access control fixes in ApiOrderService.java and update the platform to a patched version.
Other vulnerabilities in platform
See all- CVE-2025-25176Critical
Intermediate register values of secure workloads can be exfiltrated in workloads scheduled from applications running in the non-secure environment of a platform.
- CVE-2025-57213High
Incorrect access control in the orderService.queryObject component of platform v1.0.0 allows attackers to access sensitive information via a crafted request.
- CVE-2025-57210High
Incorrect access control in the ApiPayController.java component of platform v1.0.0 allows attackers to access sensitive information via unspecified vectors.
- CVE-2025-54548Medium
On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes).
Original NVD description (English source)
Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive information via a crafted request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS