CVE-2025-34293 json
GN4 Publishing System Insecure Direct Object Reference (IDOR) Information Disclosure
published 2025-10-24 12 mo ago modified 2026-10-08 31 d ago also EUVD-2025-35899
- cvss
- 8.6
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 36%
- public exploits
- 0
- none known
Summary
GN4 Publishing System versions prior to 2.6 contain an insecure direct object reference (IDOR) vulnerability via the API. Authenticated requests to the API's object endpoints allow an authenticated user to request arbitrary user IDs and receive sensitive account data for those users, including the stored password and the account's security question and answer. The exposed recovery data and encrypted password may be used to reset or take over the target account.
Patch / fix
- Naviga Global / Miles 33 GN4 Publishing System 2.6
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 12 mo ago
Exploit prediction
0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Naviga Global / Miles 33 GN4 Publishing System
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
References
-
miles33.com
/news/news/5955/naviga--miles-33--acquisition.html
media-coverage, related
-
nne.navigacloud.com
/GN4Help/gn4_introduction_to_gn4.htm
product
-
miles33.com
/section/14/gn4
product
-
vulncheck.com
/advisories/gn4-publishing-system-idor-information-disclosure
third-party-advisory
Sources
- CVE List CVE-2025-34293
- NVD CVE-2025-34293
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.