CVE-2025-2089 StarSea99 starsea-mall com.siro.mall.controller.mall.UserController updateInfo updateUserInfo access control
Attackers can modify other users' information by manipulating the userId parameter in the updateUserInfo function due to missing access controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-2089?
CVE-2025-2089 is a medium-severity missing authorization vulnerability in StarSea99 starsea-mall, published on 7 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability has been found in StarSea99 starsea-mall 1.0/2.X and classified as critical. Affected by this vulnerability is the function updateUserInfo of the file /personal/updateInfo of the component com.siro.mall.controller.mall.UserController. The manipulation of the argument userId leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Which versions are affected by CVE-2025-2089?
It affects 1 product.
Products include Starsea99 Starsea-Mall.
How do I fix CVE-2025-2089?
No fix has been published for CVE-2025-2089 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-2089 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-2089 exists.
Other vulnerabilities in StarSea99 starsea-mall
- CVE-2025-2085 StarSea99 starsea-mall save cross site scripting
- CVE-2025-2086 StarSea99 starsea-mall update cross site scripting
- CVE-2025-2087 StarSea99 starsea-mall update cross site scripting
- CVE-2025-0399 StarSea99 starsea-mall uploadController.java UploadController unrestricted upload
- CVE-2025-0400 StarSea99 starsea-mall update cross site scripting
Sources
Also known as GHSA-gg6c-59xw-8rhw.