Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Encryption of sensitive data in CapillaryScope missing

Posted date 23/07/2025
Identificador
INCIBE-2025-0401
Importance
3 - Medium
Affected Resources

CapillaryScope, versions prior to 2.5.0.

Description

INCIBE has coordinated the publication of a medium severity vulnerability affecting CapillaryScope from Capillary io, a tool for automatically analysing capillaroscopy images. The vulnerability was discovered by Ismael Melchor Juan and Pedro José Navas Pérez.

This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and vulnerability CWE type:

  • CVE-2025-40680: CVSS v4.0: 6.9 | CVSS AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | CWE-311
Solution

The vulnerability has been fixed by the Capillary io team in version 2.5.1.

Detail

CVE-2025-40680: lack o