CVE-2025-1007
Severity CVSS v4.0:
MEDIUM
Type:
Unavailable / Other
Publication date:
19/02/2025
Last modified:
19/02/2025
Description
In OpenVSX version v0.9.0 to v0.20.0, the <br />
/user/namespace/{namespace}/details API allows a user to edit all <br />
namespace details, even if the user is not a namespace Owner or <br />
Contributor. The details include: name, description, website, support <br />
link and social media links. The same issues existed in <br />
/user/namespace/{namespace}/details/logo and allowed a user to change <br />
the logo.
Impact
Base Score 4.0
6.90
Severity 4.0
MEDIUM