Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-48881
CVE-2025-48881:
Java vulnerability analysis and mitigation
Overview
CVE-2025-48881 affects Valtimo, a platform for Business Process Automation. The vulnerability exists in versions from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, where unauthorized users can access and modify objects through the object-management configuration. The vulnerability was disclosed on May 27, 2025, and is classified as a High severity issue with a CVSS score of 8.3 (GitHub Advisory).
Technical details
The vulnerability stems from an incorrect authorization implementation that allows unauthorized users to list, view, edit, create, or delete objects for which an object-management configuration exists. The attack can be executed by any logged-in user without requiring specific application roles. The vulnerability is particularly concerning as it affects objects configured via object-management, regardless of their showInDataMenu setting. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, indicating network accessibility with low attack complexity (GitHub Advisory).
Impact
The vulnerability allows unauthorized access to object contents through exposed object-urls, independent of object-management configurations. This results in potential data exposure and unauthorized modifications to system objects. The high confidentiality and integrity impact ratings in the CVSS score indicate significant potential for data breach and system manipulation (GitHub Advisory).
Mitigation and workarounds
At the time of publication, no official patch exists for this vulnerability. A temporary workaround involves overriding the endpoint security as defined in ObjectenApiHttpSecurityConfigurer and ObjectManagementHttpSecurityConfigurer, though this may result in loss of functionality (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management