Cyber Posture

CVE-2025-2320

HighPublic PoC

Published: 14 March 2025

Published
14 March 2025
Modified
22 October 2025
KEV Added
—
Patch
—
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0013 31.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

Security Summary

CVE-2025-2320 is a critical improper authorization vulnerability (CWE-266, CWE-285) affecting the submit function in the /api/blade-user/submit file of the User Handler component within the springboot-openai-chatgpt application at commit e84f6f5, developed by 274056675. The issue allows manipulation leading to improper authorization and has a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

Remote attackers require no privileges or user interaction and face low attack complexity to exploit the vulnerability. Successful exploitation can result in low-level impacts to confidentiality, integrity, and availability.

VulDB advisories note that the exploit has been publicly disclosed and may be used. The product employs rolling releases for continuous delivery, so details on affected and updated versions are unavailable. The vendor was contacted early regarding the disclosure but provided no response.

Details

CWE(s)
CWE-266CWE-285

Affected Products

274056675
springboot-openai-chatgpt
2024-12-29

AI Security Analysis

AI Category
Enterprise AI Assistants
Risk Domain
Other ATLAS/OWASP Terms
OWASP Top 10 for LLMs 2025
None mapped
MITRE ATLAS Techniques
None mapped
Classification Reason
The affected software is 'springboot-openai-chatgpt', a Spring Boot application integrating OpenAI ChatGPT for chat functionality, with user management APIs, fitting the profile of an enterprise AI assistant.

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1136 Create Account Persistence
Adversaries may create an account to maintain access to victim systems.
attack.mitre.org →
T1136.001 Local Account Persistence
Adversaries may create a local account to maintain access to victim systems.
attack.mitre.org →
T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
T1078.003 Local Accounts Stealth
Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
Why these techniques?

Improper authorization in user submit API allows logged-in users to create super administrator accounts without checks, enabling exploitation for privilege escalation (T1068), unauthorized account creation (T1136/T1136.001), and subsequent use of valid local accounts (T1078/T1078.003).

References