CVE-2025-57210
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Incorrect access control in the ApiPayController.java component of platform v1.0.0 allows attackers to access sensitive information via unspecified vectors.
Risk Assessment
An unauthorized user could access sensitive payment-related or other API data. This may lead to data leakage and confidentiality breaches.
Recommendation
Implement and verify authorization checks in ApiPayController.java to prevent unauthorized access. Update the platform to a patched version if available.
Other vulnerabilities in platform
See all- CVE-2025-25176Critical
Intermediate register values of secure workloads can be exfiltrated in workloads scheduled from applications running in the non-secure environment of a platform.
- CVE-2025-57213High
Incorrect access control in the orderService.queryObject component of platform v1.0.0 allows attackers to access sensitive information via a crafted request.
- CVE-2025-57212High
Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive information via a crafted request.
- CVE-2025-54548Medium
On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes).
Original NVD description (English source)
Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive information via unspecified vectors.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS