CVE-2025-57213
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Incorrect access control in the orderService.queryObject component of platform v1.0.0 allows attackers to access sensitive information via a crafted request.
Risk Assessment
An unauthorized user could read order data or other sensitive information they should not have access to. This may lead to data leakage and confidentiality breaches.
Recommendation
Enforce authorization checks in the orderService.queryObject component to verify the user is entitled to the requested object. Update the platform to a patched version if available.
Other vulnerabilities in platform
See all- CVE-2025-25176Critical
Intermediate register values of secure workloads can be exfiltrated in workloads scheduled from applications running in the non-secure environment of a platform.
- CVE-2025-57212High
Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive information via a crafted request.
- CVE-2025-57210High
Incorrect access control in the ApiPayController.java component of platform v1.0.0 allows attackers to access sensitive information via unspecified vectors.
- CVE-2025-54548Medium
On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes).
Original NVD description (English source)
Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensitive information via a crafted request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS